[HttpFoundation] Don't reorder nested query string keys

nicolas-grekas · nicolas-grekas · commit 2abcf97cc3f6 · 2018-02-18T18:54:43.000+01:00
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -661,6 +661,10 @@ public static function normalizeQueryString($qs)
         $parts = array();
         $order = array();
 
+        // since PHP 7, sorting is not stable anymore; we need
+        // to keep track of some original order using an index
+        $index = 0;
+
         foreach (explode('&', $qs) as $param) {
             if ('' === $param || '=' === $param[0]) {
                 // Ignore useless delimiters, e.g. "x=y&".
@@ -670,17 +674,16 @@ public static function normalizeQueryString($qs)
             }
 
             $keyValuePair = explode('=', $param, 2);
+            $key = urldecode($keyValuePair[0]);
 
             // GET parameters, that are submitted from a HTML form, encode spaces as "+" by default (as defined in enctype application/x-www-form-urlencoded).
             // PHP also converts "+" to spaces when filling the global _GET or when using the function parse_str. This is why we use urldecode and then normalize to
             // RFC 3986 with rawurlencode.
-            $parts[] = isset($keyValuePair[1]) ?
-                rawurlencode(urldecode($keyValuePair[0])).'='.rawurlencode(urldecode($keyValuePair[1])) :
-                rawurlencode(urldecode($keyValuePair[0]));
-            $order[] = urldecode($keyValuePair[0]);
+            $parts[] = rawurlencode($key).(isset($keyValuePair[1]) ? '='.rawurlencode(urldecode($keyValuePair[1])) : '');
+            $order[] = false !== ($i = strpos($key, '[')) ? substr_replace($key, \PHP_VERSION_ID >= 70000 ? ++$index : '', 1 + $i) : $key;
         }
 
-        array_multisort($order, SORT_ASC, $parts);
+        array_multisort($order, \PHP_VERSION_ID >= 70000 ? SORT_NATURAL : SORT_ASC, $parts);
 
         return implode('&', $parts);
     }
diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -658,6 +658,10 @@ public function getQueryStringNormalizationData()
             // Ignore pairs with empty key, even if there was a value, e.g. "=value", as such nameless values cannot be retrieved anyway.
             // PHP also does not include them when building _GET.
             array('foo=bar&=a=b&=x=y', 'foo=bar', 'removes params with empty key'),
+
+            // Don't reorder nested query string keys
+            array('foo[]=Z&foo[]=A', 'foo%5B%5D=Z&foo%5B%5D=A', 'keeps values order'),
+            array('foo[Z]=B&foo[A]=B', 'foo%5BZ%5D=B&foo%5BA%5D=B', 'keeps keys order'),
         );
     }
 
