Use released form data parsers.

Assisted-By: devx/e76b566a-41cd-407d-a2fd-c5b79c88879d

Author: samuel-williams-shopify

lib/utopia/request.rb

@@ -4,29 +4,18 @@
 # Copyright, 2026, by Samuel Williams.
 
 require "tempfile"
+require "stringio"
 
 require "protocol/http/request"
 require "protocol/multipart/form_data"
-require "protocol/url/encoding"
+require "protocol/url/form_data/parser"
 
 module Utopia
 	# Utopia's application-facing request wrapper.
 	#
 	# Protocol request methods are delegated to the underlying request; parsing
 	# and application conveniences live here rather than on protocol-http itself.
 	class Request
-		# The content type used by URL-encoded HTML forms.
-		FORM_URL_ENCODED = "application/x-www-form-urlencoded"
-		
-		# The content type used by multipart HTML forms.
-		MULTIPART_FORM_DATA = "multipart/form-data"
-		
-		# The maximum nesting depth accepted for structured arguments.
-		MAXIMUM_ARGUMENT_DEPTH = 8
-		
-		# The default maximum size of a URL-encoded form body.
-		MAXIMUM_URL_ENCODED_SIZE = Protocol::Multipart::FormData::MAXIMUM_FIELD_SIZE
-		
 		FORM_DATA_UNDEFINED = Object.new.freeze
 		private_constant :FORM_DATA_UNDEFINED
 
@@ -331,8 +320,8 @@ def respond_to_missing?(name, include_private = false)
 		def decode_arguments(query)
 			return {} unless query
 
-			# HTML form encoding represents spaces using `+`, while Protocol::URL uses percent encoding.
-			return Protocol::URL::Encoding.decode(query.gsub("+", "%20"), MAXIMUM_ARGUMENT_DEPTH)
+			parser = Protocol::URL::FormData::Parser.new
+			return parser.parse(StringIO.new(query))
 		end
 
 		def decode_form_data(options)
@@ -342,10 +331,9 @@ def decode_form_data(options)
 			content_type = Protocol::Multipart::Header::ContentType.coerce(value)
 
 			case content_type.type
-			when FORM_URL_ENCODED
-				maximum_size = options.fetch(:maximum_total_size, MAXIMUM_URL_ENCODED_SIZE)
-				return decode_arguments(read_body(maximum_size))
-			when MULTIPART_FORM_DATA
+			when Protocol::URL::FormData::Parser::CONTENT_TYPE
+				return decode_url_encoded_form(options)
+			when Protocol::Multipart::FormData::Parser::CONTENT_TYPE
 				boundary = content_type["boundary"]
 
 				unless boundary
@@ -358,41 +346,35 @@ def decode_form_data(options)
 			end
 		end
 
-		def read_body(maximum_size)
-			content = String.new.b
-			limit = Protocol::Multipart::ByteLimit.new(maximum_size, name: :form_size)
-			
-			if body = self.body
-				while chunk = body.read
-					limit.consume(chunk.bytesize)
-					content << chunk
-				end
-			end
+		def decode_url_encoded_form(options)
+			body = self.body
+			return {} unless body
 
-			return content
+			parser = Protocol::URL::FormData::Parser.new(**options)
+			return parser.parse(body)
 		end
 
 		def decode_multipart_form(boundary, **options)
-			arguments = {}
 			body = self.body
 
-			return arguments unless body
+			return {} unless body
 
 			io = BodyIO.new(body)
+			parser = Protocol::Multipart::FormData::Parser.new(**options)
 
 			begin
-				Protocol::Multipart::FormData.parse(io, boundary, **options) do |name, value|
+				result = parser.parse(io, boundary:) do |_name, value|
 					if value.is_a?(Protocol::Multipart::FormData::Upload)
-						value = create_upload(value)
+						create_upload(value)
+					else
+						value
 					end
-					
-					assign_argument(arguments, name, value)
 				end
 			ensure
 				io.close
 			end
 
-			return arguments
+			return result
 		end
 
 		def create_upload(upload)
@@ -411,20 +393,6 @@ def create_upload(upload)
 			end
 		end
 
-		def assign_argument(arguments, name, value)
-			keys = Protocol::URL::Encoding.split(name)
-			
-			if keys.empty?
-				raise ArgumentError, "Invalid argument name: #{name.inspect}!"
-			end
-			
-			if keys.size > MAXIMUM_ARGUMENT_DEPTH
-				raise ArgumentError, "Argument depth exceeded limit!"
-			end
-			
-			Protocol::URL::Encoding.assign(keys, value, arguments)
-		end
-		
 		def parse_cookies(cookie_header)
 			cookies = {}
 

test/utopia/application.rb

@@ -74,7 +74,7 @@ def response_object.to_response
 			Protocol::HTTP::Body::Buffered.wrap("value=large")
 		]
 
-		expect{application.call(request)}.to raise_exception(RangeError, message: be =~ /form_size exceeded/)
+		expect{application.call(request)}.to raise_exception(RangeError, message: be =~ /total_size exceeded/)
 	end
 
 	it "loads a top-level application constant" do

test/utopia/request.rb

@@ -70,6 +70,12 @@
 		}
 	end
 
+	it "distinguishes absent and empty query values" do
+		request.path = "/search?absent&empty="
+		
+		expect(request.query_arguments).to be == {"absent" => nil, "empty" => ""}
+	end
+	
 	it "decodes URL encoded form data" do
 		request.headers["content-type"] = "application/x-www-form-urlencoded"
 		request.body = Protocol::HTTP::Body::Buffered.wrap("user[name]=Samuel&query=hello+world")
@@ -111,7 +117,16 @@
 
 		expect do
 			request.form_data(maximum_total_size: 4)
-		end.to raise_exception(RangeError, message: be =~ /form_size exceeded/)
+		end.to raise_exception(RangeError, message: be =~ /total_size exceeded/)
+	end
+	
+	it "limits URL encoded form pairs" do
+		request.headers["content-type"] = "application/x-www-form-urlencoded"
+		request.body = Protocol::HTTP::Body::Buffered.wrap("a=1&b=2")
+		
+		expect do
+			request.form_data(maximum_pair_count: 1)
+		end.to raise_exception(RangeError, message: be =~ /pair_count exceeded/)
 	end
 
 	it "allows endpoint-specific limits on the first form decode" do
@@ -250,7 +265,7 @@
 		derived.headers["content-type"] = "application/x-www-form-urlencoded"
 		derived.body = Protocol::HTTP::Body::Buffered.wrap("value=large")
 
-		expect{derived.form_data}.to raise_exception(RangeError, message: be =~ /form_size exceeded/)
+		expect{derived.form_data}.to raise_exception(RangeError, message: be =~ /total_size exceeded/)
 	end
 
 	it "preserves the original request path across multiple derived requests" do

utopia.gemspec

@@ -35,8 +35,8 @@ Gem::Specification.new do |spec|
 	spec.add_dependency "msgpack"
 	spec.add_dependency "net-smtp"
 	spec.add_dependency "protocol-http", "~> 0.68"
-	spec.add_dependency "protocol-multipart", "~> 0.2"
-	spec.add_dependency "protocol-url", "~> 0.4"
+	spec.add_dependency "protocol-multipart", "~> 0.3"
+	spec.add_dependency "protocol-url", "~> 0.7"
 	spec.add_dependency "samovar", "~> 2.1"
 	spec.add_dependency "traces", "~> 0.10"
 	spec.add_dependency "variant", "~> 0.1"