84 lines
2.6 KiB
Go
84 lines
2.6 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package middleware
|
|
|
|
import (
|
|
"net/url"
|
|
"strings"
|
|
|
|
"github.com/labstack/echo/v5"
|
|
)
|
|
|
|
// NormalizeArrayParams rewrites `foo[]=...` to `foo=...` before routing,
|
|
// so handlers use a single `query:"foo"` tag for both shapes. URLSearchParams
|
|
// emits the `[]` suffix; echo doesn't unify it with repeated fields. Order
|
|
// is preserved for order-sensitive params (sort_by, order_by) when clients
|
|
// mix `foo` and `foo[]`.
|
|
func NormalizeArrayParams() echo.MiddlewareFunc {
|
|
return func(next echo.HandlerFunc) echo.HandlerFunc {
|
|
return func(c *echo.Context) error {
|
|
req := (*c).Request()
|
|
rq := req.URL.RawQuery
|
|
if rq == "" {
|
|
return next(c)
|
|
}
|
|
// Fast path: decode once and check the literal `[]` suffix —
|
|
// covers every encoding without case-by-case checks. QueryUnescape
|
|
// returns the input unchanged when there are no escapes.
|
|
decoded, err := url.QueryUnescape(rq)
|
|
if err != nil {
|
|
decoded = rq // malformed; let stripBracketSuffix sort it out
|
|
}
|
|
if !strings.Contains(decoded, "[]=") && !strings.HasSuffix(decoded, "[]") {
|
|
return next(c)
|
|
}
|
|
req.URL.RawQuery = stripBracketSuffix(rq)
|
|
return next(c)
|
|
}
|
|
}
|
|
}
|
|
|
|
// stripBracketSuffix walks the raw query pair-by-pair (rather than via
|
|
// url.ParseQuery's map) to preserve parameter order, trimming `[]` from
|
|
// keys. Values are left as-is — already URL-encoded.
|
|
func stripBracketSuffix(rq string) string {
|
|
var out strings.Builder
|
|
out.Grow(len(rq))
|
|
first := true
|
|
for _, pair := range strings.Split(rq, "&") {
|
|
if pair == "" {
|
|
continue
|
|
}
|
|
key, val, hasEq := strings.Cut(pair, "=")
|
|
decoded, err := url.QueryUnescape(key)
|
|
if err != nil {
|
|
decoded = key
|
|
}
|
|
decoded = strings.TrimSuffix(decoded, "[]")
|
|
if !first {
|
|
out.WriteByte('&')
|
|
}
|
|
first = false
|
|
out.WriteString(url.QueryEscape(decoded))
|
|
if hasEq {
|
|
out.WriteByte('=')
|
|
out.WriteString(val)
|
|
}
|
|
}
|
|
return out.String()
|
|
}
|