[HttpFoundation] add HeaderUtils::parseQueryString(): it does the same as parse_str() but preserves dots in variable names

nicolas-grekas · nicolas-grekas · commit 46cdb5d74fa9 · 2020-06-14T12:55:57.000+02:00
diff --git a/src/Symfony/Component/HttpFoundation/CHANGELOG.md b/src/Symfony/Component/HttpFoundation/CHANGELOG.md
@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+5.2.0
+-----
+
+ * added `HeaderUtils::parseQueryString()`: it does the same as `parse_str()` but preserves dots in variable names
+
 5.1.0
 -----
 
diff --git a/src/Symfony/Component/HttpFoundation/HeaderUtils.php b/src/Symfony/Component/HttpFoundation/HeaderUtils.php
@@ -193,6 +193,56 @@ public static function makeDisposition(string $disposition, string $filename, st
         return $disposition.'; '.self::toString($params, ';');
     }
 
+    /**
+     * Like parse_str(), but preserves dots in variable names.
+     */
+    public static function parseQueryString(string $qs, string $separator = '&'): array
+    {
+        $query = [];
+
+        foreach (explode($separator, $qs) as $v) {
+            if (false !== $i = strpos($v, "\0")) {
+                $v = substr($v, 0, $i);
+            }
+
+            if (false === $i = strpos($v, '=')) {
+                $k = urldecode($v);
+                $v = '';
+            } else {
+                $k = urldecode(substr($v, 0, $i));
+                $v = substr($v, $i);
+            }
+
+            if (false !== $i = strpos($k, "\0")) {
+                $k = substr($k, 0, $i);
+            }
+
+            $k = ltrim($k, ' ');
+
+            if (false === $i = strpos($k, '[')) {
+                $k = bin2hex($k);
+            } else {
+                $k = substr_replace($k, bin2hex(substr($k, 0, $i)), 0, $i);
+            }
+
+            $query[] = $k.$v;
+        }
+
+        parse_str(implode('&', $query), $query);
+
+        $result = [];
+
+        foreach ($query as $k => $v) {
+            if (false !== $i = strpos($k, '_')) {
+                $result[substr_replace($k, hex2bin(substr($k, 0, $i)).'[', 0, 1 + $i)] = $v;
+            } else {
+                $result[hex2bin($k)] = $v;
+            }
+        }
+
+        return $result;
+    }
+
     private static function groupParts(array $matches, string $separators): array
     {
         $separator = $separators[0];
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -397,7 +397,7 @@ public static function create(string $uri, string $method = 'GET', array $parame
 
         $queryString = '';
         if (isset($components['query'])) {
-            parse_str(html_entity_decode($components['query']), $qs);
+            $qs = HeaderUtils::parseQueryString(html_entity_decode($components['query']));
 
             if ($query) {
                 $query = array_replace($qs, $query);
@@ -658,7 +658,7 @@ public static function normalizeQueryString(?string $qs)
             return '';
         }
 
-        parse_str($qs, $qs);
+        $qs = HeaderUtils::parseQueryString($qs);
         ksort($qs);
 
         return http_build_query($qs, '', '&', PHP_QUERY_RFC3986);
diff --git a/src/Symfony/Component/HttpFoundation/Tests/HeaderUtilsTest.php b/src/Symfony/Component/HttpFoundation/Tests/HeaderUtilsTest.php
@@ -129,4 +129,33 @@ public function provideMakeDispositionFail()
             ['attachment', 'föö.html'],
         ];
     }
+
+    /**
+     * @dataProvider provideParseQueryString
+     */
+    public function testParseQueryString(string $queryString, string $expected = null)
+    {
+        $this->assertSame($expected ?? $queryString, http_build_query(HeaderUtils::parseQueryString($queryString), '', '&'));
+    }
+
+    public function provideParseQueryString()
+    {
+        return [
+            ['a=b&c=d'],
+            ['a.b=c'],
+            ['a+b=c'],
+            ["a\0b=c", 'a='],
+            ['a%00b=c', 'a=c'],
+            ['a[b=c', 'a%5Bb=c'],
+            ['a]b=c', 'a%5Db=c'],
+            ['a[b]=c', 'a%5Bb%5D=c'],
+            ['a[b][c.d]=c', 'a%5Bb%5D%5Bc.d%5D=c'],
+        ];
+    }
+
+    public function testParseCookieString()
+    {
+        $queryString = 'a.b=c; def%5Bg%5D=h';
+        $this->assertSame($queryString, http_build_query(HeaderUtils::parseQueryString($queryString, ';'), '', '; '));
+    }
 }
diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -805,7 +805,7 @@ public function getQueryStringNormalizationData()
             ['foo=1&foo=2', 'foo=2', 'merges repeated parameters'],
             ['pa%3Dram=foo%26bar%3Dbaz&test=test', 'pa%3Dram=foo%26bar%3Dbaz&test=test', 'works with encoded delimiters'],
             ['0', '0=', 'allows "0"'],
-            ['Foo Bar&Foo%20Baz', 'Foo_Bar=&Foo_Baz=', 'normalizes encoding in keys'],
+            ['Foo Bar&Foo%20Baz', 'Foo%20Bar=&Foo%20Baz=', 'normalizes encoding in keys'],
             ['bar=Foo Bar&baz=Foo%20Baz', 'bar=Foo%20Bar&baz=Foo%20Baz', 'normalizes encoding in values'],
             ['foo=bar&&&test&&', 'foo=bar&test=', 'removes unneeded delimiters'],
             ['formula=e=m*c^2', 'formula=e%3Dm%2Ac%5E2', 'correctly treats only the first "=" as delimiter and the next as value'],
