perf(delivery): Cow<str> values in query HashMap, drop into_owned()

form_urlencoded::parse returns Cow<str> pairs where keys and values
that require no percent-decoding are Cow::Borrowed slices into the
query string. Previously parse_query called into_owned() on every
pair unconditionally, converting Borrowed slices to freshly-allocated
Strings even when no decoding was needed.

The HashMap type changes to HashMap<Cow<str>, Cow<str>>:
- Clean alphanumeric keys/values (the common case for template
  params like 'port', 'name', 'env') stay Cow::Borrowed → zero
  String allocations per query parameter in parse_query.
- Percent-encoded values produce Cow::Owned as before.
- HashMap remains the storage type: O(1) SipHash lookup is
  preserved, and the DoS amplification vector (O(P × Q) linear
  scan) is still absent.

Cow<str> implements Borrow<str>, so HashMap::get(&str) still
works without any change at the call site in renderer::render.
The renderer's replacement closure calls .as_ref().to_owned() to
produce the required String — same allocation as before, but only
for values that actually match a placeholder.

Author: MinecraftFuns

src/delivery/mod.rs

@@ -265,13 +265,16 @@ fn etag_matches(inm: &HeaderValue, etag: &HeaderValue) -> bool {
 /// lookup in the renderer — a linear-scan structure would expose an
 /// O(placeholders × params) work factor exploitable by an attacker who sends
 /// arbitrarily many query parameters.
-fn parse_query(query: Option<&str>) -> HashMap<String, String> {
+///
+/// Keys and values that require no percent-decoding are stored as
+/// `Cow::Borrowed` slices into the query string, avoiding a heap allocation
+/// per parameter on the common clean-key path. Only percent-encoded
+/// characters produce `Cow::Owned` strings.
+fn parse_query(query: Option<&str>) -> HashMap<Cow<'_, str>, Cow<'_, str>> {
     let Some(query) = query else {
         return HashMap::new();
     };
-    form_urlencoded::parse(query.as_bytes())
-        .map(|(k, v)| (k.into_owned(), v.into_owned()))
-        .collect()
+    form_urlencoded::parse(query.as_bytes()).collect()
 }
 
 /// Resolve the response MIME type: prefer the filename extension, falling back
@@ -323,8 +326,12 @@ mod tests {
     #[test]
     fn parse_query_decodes_and_dedupes() {
         let vars = parse_query(Some("port=8080&name=hello%20world&port=9090"));
-        assert_eq!(vars.get("name").unwrap(), "hello world");
-        assert_eq!(vars.get("port").unwrap(), "9090", "last value wins");
+        assert_eq!(vars.get("name").unwrap().as_ref(), "hello world");
+        assert_eq!(
+            vars.get("port").unwrap().as_ref(),
+            "9090",
+            "last value wins"
+        );
     }
 
     #[test]

src/renderer.rs

@@ -27,11 +27,14 @@ static PLACEHOLDER: LazyLock<Regex> =
 /// heap allocation. The caller may then serve the original bytes directly (e.g.
 /// via `bytes::Bytes::from_owner`) rather than copying.
 #[must_use]
-pub fn render<'a>(template: &'a str, variables: &HashMap<String, String>) -> Cow<'a, str> {
+pub fn render<'a>(
+    template: &'a str,
+    variables: &HashMap<Cow<'_, str>, Cow<'_, str>>,
+) -> Cow<'a, str> {
     PLACEHOLDER.replace_all(template, |caps: &Captures<'_>| {
         let key = &caps[1];
         match variables.get(key) {
-            Some(value) => value.clone(),
+            Some(value) => value.as_ref().to_owned(),
             // Leave the original `{{key}}` literally in place.
             None => caps[0].to_string(),
         }
@@ -42,10 +45,10 @@ pub fn render<'a>(template: &'a str, variables: &HashMap<String, String>) -> Cow
 mod tests {
     use super::*;
 
-    fn vars(pairs: &[(&str, &str)]) -> HashMap<String, String> {
+    fn vars<'a>(pairs: &[(&'a str, &'a str)]) -> HashMap<Cow<'a, str>, Cow<'a, str>> {
         pairs
             .iter()
-            .map(|(k, v)| ((*k).to_string(), (*v).to_string()))
+            .map(|(k, v)| (Cow::Borrowed(*k), Cow::Borrowed(*v)))
             .collect()
     }