Fix incorrect handling of url-encoded parameters in FormFilter

[Shawyeok]

Fix #3929

[Shawyeok]

Do you have a chance to take a look about this?
@spencergibb @raccoonback

[raccoonback]

@Shawyeok
That’s a good point.
Basically, it seems that this issue occurs because the encoded query string returned by the HttpServletRequest implementation is used as-is.
Regardless of the specific HttpServletRequest implementation, I think defensively decoding it is a good idea.

However, instead of creating a new MvcUtils.decodeQueryParams() method, how about performing the decoding directly at line 117 with UriUtils.decode(request.getQueryString())?
It doesn’t seem necessary to introduce a separate MvcUtils.decodeQueryParams() method.

such as, ...

		Map<String, String[]> form = request.getParameterMap();
		String queryString = UriUtils.decode(request.getQueryString(), StandardCharsets.UTF_8); // try decoding
		StringBuffer requestURL = request.getRequestURL();
		if (StringUtils.hasText(queryString)) {
			requestURL.append('?').append(queryString);
		}
		UriComponentsBuilder uriComponentsBuilder = UriComponentsBuilder.fromUriString(requestURL.toString());
		MultiValueMap<String, String> queryParams = uriComponentsBuilder.build().getQueryParams();
		for (Iterator<Map.Entry<String, String[]>> entryIterator = form.entrySet().iterator(); entryIterator
			.hasNext();) {
       // ...
        }

[Shawyeok]

Sorry for late reply. We should decode each query parameter independently. For example, in the code you provided above, a query string like q=k%26r would cause an issue.

Therefore, all we need is a utility function that can decode a query string into a multi-value map. I’ve refined the patch — please take a look when you have a moment.

[raccoonback]

lgtm