[HttpClient] Fix over-encoding of URL parts to match browser's behavior

nicolas-grekas · nicolas-grekas · commit 217409d16226 · 2023-02-08T16:45:51.000+01:00
diff --git a/src/Symfony/Component/HttpClient/HttpClientTrait.php b/src/Symfony/Component/HttpClient/HttpClientTrait.php
@@ -547,7 +547,7 @@ private static function parseUrl(string $url, array $query = [], array $allowedS
             }
 
             // https://tools.ietf.org/html/rfc3986#section-3.3
-            $parts[$part] = preg_replace_callback("#[^-A-Za-z0-9._~!$&/'()*+,;=:@%]++#", function ($m) { return rawurlencode($m[0]); }, $parts[$part]);
+            $parts[$part] = preg_replace_callback("#[^-A-Za-z0-9._~!$&/'()[\]*+,;=:@\\\\^`{|}%]++#", function ($m) { return rawurlencode($m[0]); }, $parts[$part]);
         }
 
         return [
@@ -621,6 +621,11 @@ private static function mergeQueryString(?string $queryString, array $queryArray
         $queryArray = [];
 
         if ($queryString) {
+            if (str_contains($queryString, '%')) {
+                // https://tools.ietf.org/html/rfc3986#section-2.3
+                $queryString = preg_replace_callback('/%(?:2[148-F]|3[0-B]|40|[46][1-9A-F]|5F|60|[57][0-E])++/i', function ($m) { return rawurldecode($m[0]); }, $queryString);
+            }
+
             foreach (explode('&', $queryString) as $v) {
                 $queryArray[rawurldecode(explode('=', $v, 2)[0])] = $v;
             }
diff --git a/src/Symfony/Component/HttpClient/Tests/HttpClientTraitTest.php b/src/Symfony/Component/HttpClient/Tests/HttpClientTraitTest.php
@@ -157,12 +157,12 @@ public function provideParseUrl(): iterable
         yield [['http:', null, null, null, null], 'http:'];
         yield [['http:', null, 'bar', null, null], 'http:bar'];
         yield [[null, null, 'bar', '?a=1&c=c', null], 'bar?a=a&b=b', ['b' => null, 'c' => 'c', 'a' => 1]];
-        yield [[null, null, 'bar', '?a=b+c&b=b', null], 'bar?a=b+c', ['b' => 'b']];
-        yield [[null, null, 'bar', '?a=b%2B%20c', null], 'bar?a=b+c', ['a' => 'b+ c']];
-        yield [[null, null, 'bar', '?a%5Bb%5D=c', null], 'bar', ['a' => ['b' => 'c']]];
-        yield [[null, null, 'bar', '?a%5Bb%5Bc%5D=d', null], 'bar?a[b[c]=d', []];
-        yield [[null, null, 'bar', '?a%5Bb%5D%5Bc%5D=dd', null], 'bar?a[b][c]=d&e[f]=g', ['a' => ['b' => ['c' => 'dd']], 'e[f]' => null]];
-        yield [[null, null, 'bar', '?a=b&a%5Bb%20c%5D=d&e%3Df=%E2%9C%93', null], 'bar?a=b', ['a' => ['b c' => 'd'], 'e=f' => '✓']];
+        yield [[null, null, 'bar', '?a=b+c&b=b-._~!$%26/%27()[]*+,;%3D:@%25\\^`{|}', null], 'bar?a=b+c', ['b' => 'b-._~!$&/\'()[]*+,;=:@%\\^`{|}']];
+        yield [[null, null, 'bar', '?a=b+%20c', null], 'bar?a=b+c', ['a' => 'b+ c']];
+        yield [[null, null, 'bar', '?a[b]=c', null], 'bar', ['a' => ['b' => 'c']]];
+        yield [[null, null, 'bar', '?a[b[c]=d', null], 'bar?a[b[c]=d', []];
+        yield [[null, null, 'bar', '?a[b][c]=dd', null], 'bar?a[b][c]=d&e[f]=g', ['a' => ['b' => ['c' => 'dd']], 'e[f]' => null]];
+        yield [[null, null, 'bar', '?a=b&a[b%20c]=d&e%3Df=%E2%9C%93', null], 'bar?a=b', ['a' => ['b c' => 'd'], 'e=f' => '✓']];
         // IDNA 2008 compliance
         yield [['https:', '//xn--fuball-cta.test', null, null, null], 'https://fußball.test'];
     }

Original file line number	Diff line number	Diff line change
`@@ -547,7 +547,7 @@ private static function parseUrl(string $url, array $query = [], array $allowedS`
`547`	`547`	`}`
`548`	`548`
`549`	`549`	`// https://tools.ietf.org/html/rfc3986#section-3.3`
`550`		`- $parts[$part] = preg_replace_callback("#[^-A-Za-z0-9._~!$&/'()*+,;=:@%]++#", function ($m) { return rawurlencode($m[0]); }, $parts[$part]);`
	`550`	+ $parts[$part] = preg_replace_callback("#[^-A-Za-z0-9._~!$&/'()[\]*+,;=:@\\\\^`{\|}%]++#", function ($m) { return rawurlencode($m[0]); }, $parts[$part]);
`551`	`551`	`}`
`552`	`552`
`553`	`553`	`return [`
`@@ -621,6 +621,11 @@ private static function mergeQueryString(?string $queryString, array $queryArray`
`621`	`621`	`$queryArray = [];`
`622`	`622`
`623`	`623`	`if ($queryString) {`
	`624`	`+ if (str_contains($queryString, '%')) {`
	`625`	`+ // https://tools.ietf.org/html/rfc3986#section-2.3`
	`626`	`+ $queryString = preg_replace_callback('/%(?:2[148-F]\|3[0-B]\|40\|[46][1-9A-F]\|5F\|60\|[57][0-E])++/i', function ($m) { return rawurldecode($m[0]); }, $queryString);`
	`627`	`+ }`
	`628`	`+`
`624`	`629`	`foreach (explode('&', $queryString) as $v) {`
`625`	`630`	`$queryArray[rawurldecode(explode('=', $v, 2)[0])] = $v;`
`626`	`631`	`}`