symfony/symfony — Issue #2579: [HttpFoundation] Urldecoding pathinfo
Author: geezmo
Created: 2011-11-08 10:49:11+00:00
State: open

Hello everybody.
I discovered yesterday a (maybe odd?) behaviour of the framework dealing with route parameters. I would like to know your opinion before opening a pull request, if needed.

In HttpFoundation/Request.php

```php
protected function preparePathInfo()
{
(...)

if ((null !== $baseUrl) && (false === ($pathInfo = substr(urldecode($requestUri), strlen(urldecode($baseUrl)))))) {
// If substr() returns false then PATH_INFO is set to an empty string
return '/';
} elseif (null === $baseUrl) {
return $requestUri;
}

return (string) $pathInfo;
}
```

and in Routing/Matcher/UrlMatcher.php

```php

protected function matchCollection($pathinfo, RouteCollection $routes)
{
$pathinfo = urldecode($pathinfo);

(...)
```

pathInfo is urldecoded before route matching. My 2 questions are:

1. Is there a reason why it is urldecoded twice?
2. Is there a reason why it is urldecoded at all? :-)

A brief explanation of my second question: suppose the url contains a token which is base64-encoded and then urlencoded. The slash character (%2F urlencoded) is valid base64, and that is a valid url - but due to pathInfo urldecoding that route will never match. Shouldn't parameters be urldecoded only *after* route matching, and not before? Am i missing something?