From 2e3a0899138bb7ad34e82d5bfda5f4a4b00aeffe Mon Sep 17 00:00:00 2001
From: arshiya tabasum <arshi@bugqore.com>
Date: Wed, 22 Jul 2026 13:04:21 +0530
Subject: [PATCH] fix(http): keep `=` encoded in HttpParams keys

A parameter name containing `=` was emitted unencoded, so the pair re-read as a
different name. Restore `=` only when encoding a value, where the first `=` has
already delimited the pair.

Fixes #11058

BREAKING CHANGE: The default `HttpUrlEncodingCodec` now percent-encodes `=` in
parameter keys instead of leaving it literal. A key containing `=` serializes as
`filter%3Dadmin=true` rather than `filter=admin=true`, so a backend that relied on
the old, ambiguous output will see a different query string. Value encoding is
unchanged. Applications that need the previous behaviour can supply a custom
`HttpParameterCodec`.
---
 packages/common/http/src/params.ts       | 20 +++++++++++---------
 packages/common/http/test/params_spec.ts |  9 +++++++++
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/packages/common/http/src/params.ts b/packages/common/http/src/params.ts
index b82b65771536..525f655ccbae 100644
--- a/packages/common/http/src/params.ts
+++ b/packages/common/http/src/params.ts
@@ -44,7 +44,7 @@ export class HttpUrlEncodingCodec implements HttpParameterCodec {
    * @returns The encoded key name.
    */
   encodeKey(key: string): string {
-    return standardEncoding(key);
+    return standardEncoding(key, KEY_ENCODING_REPLACEMENTS);
   }
 
   /**
@@ -53,7 +53,7 @@ export class HttpUrlEncodingCodec implements HttpParameterCodec {
    * @returns The encoded value.
    */
   encodeValue(value: string): string {
-    return standardEncoding(value);
+    return standardEncoding(value, VALUE_ENCODING_REPLACEMENTS);
   }
 
   /**
@@ -100,22 +100,24 @@ function paramParser(rawParams: string, codec: HttpParameterCodec): Map<string,
  * Encode input string with standard encodeURIComponent and then un-encode specific characters.
  */
 const STANDARD_ENCODING_REGEX = /%(\d[a-f0-9])/gi;
-const STANDARD_ENCODING_REPLACEMENTS: {[x: string]: string} = {
+const KEY_ENCODING_REPLACEMENTS: {[x: string]: string} = {
   '40': '@',
   '3A': ':',
   '24': '$',
   '2C': ',',
   '3B': ';',
-  '3D': '=',
   '3F': '?',
   '2F': '/',
 };
+// A pair is split at its first `=`, so that character only carries its literal meaning in a
+// value and has to stay percent-encoded in a key.
+const VALUE_ENCODING_REPLACEMENTS: {[x: string]: string} = {
+  ...KEY_ENCODING_REPLACEMENTS,
+  '3D': '=',
+};
 
-function standardEncoding(v: string): string {
-  return encodeURIComponent(v).replace(
-    STANDARD_ENCODING_REGEX,
-    (s, t) => STANDARD_ENCODING_REPLACEMENTS[t] ?? s,
-  );
+function standardEncoding(v: string, replacements: {[x: string]: string}): string {
+  return encodeURIComponent(v).replace(STANDARD_ENCODING_REGEX, (s, t) => replacements[t] ?? s);
 }
 
 function valueToString(value: string | number | boolean): string {
diff --git a/packages/common/http/test/params_spec.ts b/packages/common/http/test/params_spec.ts
index 799898581001..1a2f3db7201f 100644
--- a/packages/common/http/test/params_spec.ts
+++ b/packages/common/http/test/params_spec.ts
@@ -180,6 +180,15 @@ describe('HttpUrlEncodedParams', () => {
       const body2 = new HttpParams({fromString: 'a=1 2 3&b=mail@test&c=3_^[]$&d=eq=1&e=1+1'});
       expect(body2.toString()).toEqual('a=1%202%203&b=mail@test&c=3_%5E%5B%5D$&d=eq=1&e=1%2B1');
     });
+
+    it('should keep `=` encoded in a key so the pair round-trips', () => {
+      const body = new HttpParams().set('filter=admin', 'true');
+      expect(body.toString()).toEqual('filter%3Dadmin=true');
+
+      const reparsed = new HttpParams({fromString: body.toString()});
+      expect(reparsed.keys()).toEqual(['filter=admin']);
+      expect(reparsed.get('filter=admin')).toEqual('true');
+    });
   });
 
   describe('toString', () => {