Symfony version(s) affected

5.4.21

Description

This issue is related to #49579

In symfony 5.4.21 a breaking change has been introduced causing some characters in the query part of urls to not be escaped anymore. symfony/http-client@v5.4.20...v5.4.21 -> HttpClientTrait::mergeQueryString

To give some context, we're calling a third party service with a query parameters like this:

['query' => ['filter' => '{"publicationId":' . self::PUBLICATION_ID_TO_IMPORT . '}']]

Originally, the query would be escaped to this: %7B%publicationId%22:1%7D, but since the { and } are not escaped anymore, the query stays like this: {%22publicationId%22:1}

Which the third party doesn't handle very well and returns with a 500 status code.

An obvious fix on our side would be to escape { and } ourselves. But then the http client escapes %, which causes %7B%publicationId%22:1%7D to become %257B%22publicationId%22:1%257D

So what I'm left at is either not escaping, or to much escaping

How to reproduce

Make HttpClientTrait::mergeQueryString public for easier access.

<?php

require_once __DIR__ . '/vendor/autoload.php';

use Symfony\Component\HttpClient\CurlHttpClient;

$q = CurlHttpClient::mergeQueryString(null, ['filter' => '{"publicationId":1}'], true);
var_dump($q);

Result:
Pre 5.4.21: filter=%7B%22publicationId%22%3A1%7D
5.4.21: filter={%22publicationId%22:1}

Possible Solution

No response

Additional Context

No response