lib/rack/query_parser.rb in rack-3.0.5 vs lib/rack/query_parser.rb in rack-3.0.6

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 module Rack
   class QueryParser
     DEFAULT_SEP = /[&] */n
     COMMON_SEP = { ";" => /[;] */n, ";," => /[;,] */n, "&" => /[&] */n }
 
@@ -109,10 +111,18 @@
     # earlier versions of rack.
     def normalize_params(params, name, v, _depth=nil)
       _normalize_params(params, name, v, 0)
     end
 
+    # This value is used by default when a parameter is missing (nil). This
+    # usually happens when a parameter is specified without an `=value` part.
+    # The default value is an empty string, but this can be overridden by
+    # subclasses.
+    def missing_value
+      String.new
+    end
+
     private def _normalize_params(params, name, v, depth)
       raise ParamsTooDeepError if depth >= param_depth_limit
 
       if !name
         # nil name, treat same as empty string (required by tests)
@@ -143,11 +153,11 @@
         after = ''
       end
 
       return if k.empty?
 
-      v ||= String.new
+      v ||= missing_value
 
       if after == ''
         if k == '[]' && depth != 0
           return [v]
         else
@@ -205,11 +215,11 @@
       end
 
       true
     end
 
-    def unescape(s)
-      Utils.unescape(s)
+    def unescape(string, encoding = Encoding::UTF_8)
+      URI.decode_www_form_component(string, encoding)
     end
 
     class Params
       def initialize
         @size   = 0