fix: Disables implicit Cookies url decoding

[M4tteoP]

Tentatively closes #920.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (13771ff) 82.57% compared to head (b6408e1) 82.58%.
Report is 1 commits behind head on main.

❗ Current head b6408e1 differs from pull request most recent head 9202309. Consider uploading reports for the commit 9202309 to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #928   +/-   ##
=======================================
  Coverage   82.57%   82.58%           
=======================================
  Files         160      160           
  Lines        8988     8991    +3     
=======================================
+ Hits         7422     7425    +3     
  Misses       1317     1317           
  Partials      249      249           

Flag	Coverage Δ
default	77.67% <100.00%> (+0.02%)	⬆️
examples	26.60% <30.76%> (+0.03%)	⬆️
ftw	47.03% <100.00%> (+0.01%)	⬆️
ftw-multiphase	49.23% <100.00%> (+0.01%)	⬆️
tinygo	75.20% <100.00%> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jptosso]

I still think we split the function instead of using using a Boolean constant

[jcchavezs]

I still think we split the function instead of using using a Boolean constant

Kind of agree but that would require to copy the code. Another option could be:

type kvEscape func(string) string

var (
	urlUnescape  kvEscape = QueryUnescape
	NoEscape      kvEscape = func(s string) { return s }
)

...

q := ParseQuery(out, '&', urlUnescape)

[anuraaga]

We could split the API with private function

func ParseQuery(string)
func ParseQueryWithoutUnescape(string)

func doParseQuery(string, bool)

[M4tteoP]

Old comment about making it private: #326 (comment)

[jcchavezs]

I love when code becomes private.

[M4tteoP]

Thank you all for the inputs!
I went for the doParseQuery avoiding public booleans and I did a minor refactor to QueryUnescape to improve a bit the readability. I can not notice meaningful differences in benchmarks:

QueryUnescape
Before:

goos: darwin
goarch: arm64
pkg: github.com/corazawaf/coraza/v3/internal/url
BenchmarkQueryUnescape-10    	 4639016	       252.8 ns/op	      78 B/op	       7 allocs/op
PASS
ok  	github.com/corazawaf/coraza/v3/internal/url	1.526s

After:

goos: darwin
goarch: arm64
pkg: github.com/corazawaf/coraza/v3/internal/url
BenchmarkQueryUnescape-10    	 4720306	       249.2 ns/op	      78 B/op	       7 allocs/op
PASS
ok  	github.com/corazawaf/coraza/v3/internal/url	1.515s

ParseQuery (same QueryUnescape)
Before:

goos: darwin
goarch: arm64
pkg: github.com/corazawaf/coraza/v3/internal/url
BenchmarkParseQuery-10    	 2169714	       544.6 ns/op	     627 B/op	       5 allocs/op
PASS
ok  	github.com/corazawaf/coraza/v3/internal/url	1.835s

After:

goos: darwin
goarch: arm64
pkg: github.com/corazawaf/coraza/v3/internal/url
BenchmarkParseQuery-10    	 2197615	       544.0 ns/op	     627 B/op	       5 allocs/op
PASS
ok  	github.com/corazawaf/coraza/v3/internal/url	1.842s

[M4tteoP]

Merging, mind that in the next release, I would write a line about this engine behavior change