Merge pull request #25 from collbox/invalid-url-encoding-handling

Exclude decoded params on invalid URL encoding

Author: weavejester

src/ring/util/codec.clj

@@ -141,8 +141,11 @@
      (form-decode-str encoded encoding)
      (reduce
       (fn [m param]
-        (if-let [[k v] (str/split param #"=" 2)]
-          (assoc-conj m (form-decode-str k encoding) (form-decode-str (or v "") encoding))
-          m))
+        (let [[k v] (str/split param #"=" 2)
+              k     (form-decode-str k encoding)
+              v     (form-decode-str (or v "") encoding)]
+          (if (and k v)
+            (assoc-conj m k v)
+            m)))
       {}
       (str/split encoded #"&")))))

test/ring/util/test/codec.clj

@@ -65,6 +65,14 @@
     "a=b%2Fc" {"a" "b/c"}
     "a=b&c"   {"a" "b" "c" ""}
     "a=&b=c"  {"a" "" "b" "c"}
-    "a&b=c"   {"a" "" "b" "c"})
+    "a&b=c"   {"a" "" "b" "c"}
+    "="       {"" ""}
+    "a="      {"a" ""}
+    "=b"      {"" "b"})
+  (testing "invalid URL encoding"
+    (are [x y] (= (form-decode x) y)
+      "%=b" {}
+      "a=%" {}
+      "%=%" {}))
   (is (= (form-decode "a=foo%FE%FF%00%2Fbar" "UTF-16")
          {"a" "foo/bar"})))