Skip to content

Conversation

@timkelty
Copy link
Contributor

@timkelty timkelty commented Sep 9, 2025

Description

UrlHelper::buildQuery can produce invalid urls with decoded brackets ?foo[]=bar.

Because of some special cases with ?var={variables} in URLs, we need to preserve some characters from encoding, but I'm not sure why we'd ever need to decode the name. Are there any known use cases of something like:
?param[{id}]=value?

There is a history of fixes & reverts, so even though this is one line, it shouldn't be merged lightly.

I tried to dig through the history a bit:

  • initial use of urldecode: 89b54ed
  • moved to buildQuery: 92fa26c
  • Deprecate buildQuery , and drop urldecode 2e97c56
    • This PR brings us back to this state, but without deprecating buildQuery.
  • Revert fix (adds buildQuery with urldecode back): 50f50ea

I added some tests and notes where things changed.

Related issues

@brandonkelly brandonkelly changed the base branch from 4.x to 4.17 September 10, 2025 19:02
@brandonkelly brandonkelly merged commit d4d1d61 into 4.17 Sep 10, 2025
4 checks passed
@brandonkelly brandonkelly deleted the bugfix/bracket-encoding-url branch September 10, 2025 19:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants