search

PolymerElements / iron-location

A Polymer element that manages binding to the page's URL.
22 stars 41 forks source link

`iron-query-params` does not correctly decode + in query string values. #45

Closed palli closed 8 years ago

palli commented 8 years ago

Seems like internally iron-query-params uses decodeUriComponent to decode query string into a dictionary.

encodeUri and decodeUri expect spaces to be encoded as %20, however when it comes to query string values (not the url part of the uri), then encoding spaces as + is also valid, but decodeUriComponent does not take this into account, despite this being a common encoding way in many libraries.

Google closure libraries work around this by explicitly doing a .replace() in addition to calling decodeUriComponent. See http://www.hobsonassoc.com/scripts/closure/goog/docs/closure_goog_string_string.js.source.html#line425 for example.

Expected

  '?foo=value+with+spaces' => {'foo': 'value with spaces'}

Actual outcome

  '?foo=value+with+spaces' => {'foo': 'value+with+spaces'}

Browsers Affected

At least chrome. Probably all.