From 0e2b099be537a2cc4f1b73e3407c53d094458fae Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 9 Mar 2026 22:55:26 +0000
Subject: [PATCH 1/2] Initial plan


From 4848b9f9b815d545ff3000568929f35aa8b71ad4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 9 Mar 2026 23:03:01 +0000
Subject: [PATCH 2/2] test: add more coverage for raw argument collections

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>
---
 go.sum                                     |   2 -
 internal/bodyprocessors/multipart_test.go  |  40 +++++++
 internal/bodyprocessors/urlencoded_test.go |  60 ++++++++++
 internal/corazawaf/transaction_test.go     | 123 +++++++++++++++++++++
 internal/url/url_test.go                   |  80 ++++++++++++++
 testing/coreruleset/go.mod                 |   2 +-
 testing/coreruleset/go.sum                 |   4 +-
 testing/engine/args_raw.go                 |  85 ++++++++++++++
 8 files changed, 391 insertions(+), 5 deletions(-)

diff --git a/go.sum b/go.sum
index 6286aac04..6f81a85ee 100644
--- a/go.sum
+++ b/go.sum
@@ -75,8 +75,6 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
diff --git a/internal/bodyprocessors/multipart_test.go b/internal/bodyprocessors/multipart_test.go
index 97b9b63b1..d3608cbb5 100644
--- a/internal/bodyprocessors/multipart_test.go
+++ b/internal/bodyprocessors/multipart_test.go
@@ -330,3 +330,43 @@ text defa`)
 		t.Fatalf("expected ArgsPost 'text' to be 'text defa', got %q", textValues[0])
 	}
 }
+
+func TestMultipartArgsPostRaw(t *testing.T) {
+	// For multipart, field values are not URL-encoded, so ArgsPostRaw should equal ArgsPost.
+	payload := strings.TrimSpace(`
+-----------------------------9051914041544843365972754266
+Content-Disposition: form-data; name="username"
+
+john_doe
+-----------------------------9051914041544843365972754266
+Content-Disposition: form-data; name="comment"
+
+hello world
+-----------------------------9051914041544843365972754266--
+`)
+
+	mp := multipartProcessor(t)
+	v := corazawaf.NewTransactionVariables()
+	if err := mp.ProcessRequest(strings.NewReader(payload), v, plugintypes.BodyProcessorOptions{
+		Mime: "multipart/form-data; boundary=---------------------------9051914041544843365972754266",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// ArgsPost and ArgsPostRaw should both contain the field values (raw == cooked for multipart).
+	argsPost := v.ArgsPost()
+	argsPostRaw := v.ArgsPostRaw()
+
+	fields := map[string]string{
+		"username": "john_doe",
+		"comment":  "hello world",
+	}
+	for field, want := range fields {
+		if got := argsPost.Get(field); len(got) == 0 || got[0] != want {
+			t.Errorf("ArgsPost[%q]: got %v, want %q", field, got, want)
+		}
+		if got := argsPostRaw.Get(field); len(got) == 0 || got[0] != want {
+			t.Errorf("ArgsPostRaw[%q]: got %v, want %q", field, got, want)
+		}
+	}
+}
diff --git a/internal/bodyprocessors/urlencoded_test.go b/internal/bodyprocessors/urlencoded_test.go
index c9912483a..d0059d248 100644
--- a/internal/bodyprocessors/urlencoded_test.go
+++ b/internal/bodyprocessors/urlencoded_test.go
@@ -13,6 +13,66 @@ import (
 	"github.com/corazawaf/coraza/v3/internal/corazawaf"
 )
 
+func TestURLEncodeRawValues(t *testing.T) {
+	bp, err := bodyprocessors.GetBodyProcessor("urlencoded")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name         string
+		body         string
+		wantCooked   map[string]string // decoded value in ArgsPost
+		wantRaw      map[string]string // raw value in ArgsPostRaw
+	}{
+		{
+			name:       "percent-encoded value",
+			body:       "key=%3Cscript%3E",
+			wantCooked: map[string]string{"key": "<script>"},
+			wantRaw:    map[string]string{"key": "%3Cscript%3E"},
+		},
+		{
+			name:       "double-encoded value",
+			body:       "password=Secret%2500",
+			wantCooked: map[string]string{"password": "Secret%00"},
+			wantRaw:    map[string]string{"password": "Secret%2500"},
+		},
+		{
+			name:       "plus sign preserved in raw",
+			body:       "q=hello+world",
+			wantCooked: map[string]string{"q": "hello world"},
+			wantRaw:    map[string]string{"q": "hello+world"},
+		},
+		{
+			name:       "plain value identical in both",
+			body:       "plain=hello",
+			wantCooked: map[string]string{"plain": "hello"},
+			wantRaw:    map[string]string{"plain": "hello"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			v := corazawaf.NewTransactionVariables()
+			if err := bp.ProcessRequest(strings.NewReader(tc.body), v, plugintypes.BodyProcessorOptions{}); err != nil {
+				t.Fatal(err)
+			}
+			for k, want := range tc.wantCooked {
+				got := v.ArgsPost().Get(k)
+				if len(got) == 0 || got[0] != want {
+					t.Errorf("ArgsPost[%q]: got %v, want %q", k, got, want)
+				}
+			}
+			for k, want := range tc.wantRaw {
+				got := v.ArgsPostRaw().Get(k)
+				if len(got) == 0 || got[0] != want {
+					t.Errorf("ArgsPostRaw[%q]: got %v, want %q", k, got, want)
+				}
+			}
+		})
+	}
+}
+
 func TestURLEncode(t *testing.T) {
 	bp, err := bodyprocessors.GetBodyProcessor("urlencoded")
 	if err != nil {
diff --git a/internal/corazawaf/transaction_test.go b/internal/corazawaf/transaction_test.go
index 4d6ac28cb..701480ef9 100644
--- a/internal/corazawaf/transaction_test.go
+++ b/internal/corazawaf/transaction_test.go
@@ -1712,6 +1712,129 @@ func TestAddResponseArgsWithOverlimit(t *testing.T) {
 	}
 }
 
+func TestExtractGetArgumentsRaw(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("key=%3Cscript%3E&plain=hello&p%61ram=value")
+
+	// Decoded values in argsGet
+	if v := tx.variables.argsGet.Get("key"); len(v) == 0 || v[0] != "<script>" {
+		t.Errorf("argsGet key: got %v, want [<script>]", v)
+	}
+	if v := tx.variables.argsGet.Get("plain"); len(v) == 0 || v[0] != "hello" {
+		t.Errorf("argsGet plain: got %v, want [hello]", v)
+	}
+	if v := tx.variables.argsGet.Get("param"); len(v) == 0 || v[0] != "value" {
+		t.Errorf("argsGet param (decoded key): got %v, want [value]", v)
+	}
+
+	// Raw values in argsGetRaw — percent-encoding preserved
+	if v := tx.variables.argsGetRaw.Get("key"); len(v) == 0 || v[0] != "%3Cscript%3E" {
+		t.Errorf("argsGetRaw key: got %v, want [%%3Cscript%%3E]", v)
+	}
+	if v := tx.variables.argsGetRaw.Get("plain"); len(v) == 0 || v[0] != "hello" {
+		t.Errorf("argsGetRaw plain: got %v, want [hello]", v)
+	}
+	// Raw key name is also preserved
+	if v := tx.variables.argsGetRaw.Get("p%61ram"); len(v) == 0 || v[0] != "value" {
+		t.Errorf("argsGetRaw p%%61ram: got %v, want [value]", v)
+	}
+}
+
+func TestExtractGetArgumentsRawPlusSign(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("q=hello+world")
+
+	// Decoded: "+" becomes " "
+	if v := tx.variables.argsGet.Get("q"); len(v) == 0 || v[0] != "hello world" {
+		t.Errorf("argsGet q: got %v, want [hello world]", v)
+	}
+	// Raw: "+" is preserved
+	if v := tx.variables.argsGetRaw.Get("q"); len(v) == 0 || v[0] != "hello+world" {
+		t.Errorf("argsGetRaw q: got %v, want [hello+world]", v)
+	}
+}
+
+func TestExtractGetArgumentsRawDoubleEncoding(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("payload=Secret%2500")
+
+	// Decoded: %25 → % giving "Secret%00"
+	if v := tx.variables.argsGet.Get("payload"); len(v) == 0 || v[0] != "Secret%00" {
+		t.Errorf("argsGet payload: got %v, want [Secret%%00]", v)
+	}
+	// Raw: double-encoding preserved as-is
+	if v := tx.variables.argsGetRaw.Get("payload"); len(v) == 0 || v[0] != "Secret%2500" {
+		t.Errorf("argsGetRaw payload: got %v, want [Secret%%2500]", v)
+	}
+}
+
+func TestExtractGetArgumentsRawNamesCollection(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("p%61ram=value&other=hello")
+
+	// argsGetNamesRaw should contain the raw (non-decoded) key names.
+	rawNames := tx.variables.argsGetNamesRaw.FindAll()
+	found := false
+	for _, md := range rawNames {
+		if md.Value() == "p%61ram" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("argsGetNamesRaw: expected to find 'p%%61ram', got %v", rawNames)
+	}
+}
+
+func TestAddRawGetArgsWithOverlimit(t *testing.T) {
+	testCases := []int{1, 2, 5, 1000}
+
+	for _, limit := range testCases {
+		waf := NewWAF()
+		tx := waf.NewTransaction()
+		tx.WAF.ArgumentLimit = limit
+		// Call addGetRequestArgumentRaw directly (same package) to test the limit path.
+		for i := 0; i < limit+1; i++ {
+			tx.addGetRequestArgumentRaw(fmt.Sprintf("testKey%d", i), "samplevalue")
+		}
+		if tx.variables.argsGetRaw.Len() > waf.ArgumentLimit {
+			t.Fatalf("Argument limit failed for raw GET args (limit=%d, got %d)", limit, tx.variables.argsGetRaw.Len())
+		}
+
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}
+}
+
 func TestResponseBodyForceProcessing(t *testing.T) {
 	waf := NewWAF()
 	waf.ResponseBodyAccess = true
diff --git a/internal/url/url_test.go b/internal/url/url_test.go
index 137d0cde4..ef54d0986 100644
--- a/internal/url/url_test.go
+++ b/internal/url/url_test.go
@@ -149,3 +149,83 @@ func TestParseQueryBoth(t *testing.T) {
 		t.Errorf("raw plain: got %v, want [hello]", v)
 	}
 }
+
+func TestParseQueryBothPlusSigns(t *testing.T) {
+	// Plus signs: decoded as space in cooked, preserved literally in raw.
+	input := "q=hello+world&tag=foo+bar"
+	decoded, raw := ParseQueryBoth(input, '&')
+
+	if v := decoded["q"]; len(v) != 1 || v[0] != "hello world" {
+		t.Errorf("decoded q: got %v, want [hello world]", v)
+	}
+	if v := raw["q"]; len(v) != 1 || v[0] != "hello+world" {
+		t.Errorf("raw q: got %v, want [hello+world]", v)
+	}
+	if v := decoded["tag"]; len(v) != 1 || v[0] != "foo bar" {
+		t.Errorf("decoded tag: got %v, want [foo bar]", v)
+	}
+	if v := raw["tag"]; len(v) != 1 || v[0] != "foo+bar" {
+		t.Errorf("raw tag: got %v, want [foo+bar]", v)
+	}
+}
+
+func TestParseQueryBothMultipleValues(t *testing.T) {
+	// Multiple values for the same key.
+	input := "color=red&color=blue&color=gr%65en"
+	decoded, raw := ParseQueryBoth(input, '&')
+
+	if v := decoded["color"]; len(v) != 3 || v[0] != "red" || v[1] != "blue" || v[2] != "green" {
+		t.Errorf("decoded color: got %v, want [red blue green]", v)
+	}
+	if v := raw["color"]; len(v) != 3 || v[0] != "red" || v[1] != "blue" || v[2] != "gr%65en" {
+		t.Errorf("raw color: got %v, want [red blue gr%%65en]", v)
+	}
+}
+
+func TestParseQueryRawMultipleValues(t *testing.T) {
+	input := "x=a&x=b%20c&x=d+e"
+	got := ParseQueryRaw(input, '&')
+
+	vals, ok := got["x"]
+	if !ok {
+		t.Fatal("missing key x")
+	}
+	if len(vals) != 3 {
+		t.Fatalf("expected 3 values, got %d: %v", len(vals), vals)
+	}
+	expected := []string{"a", "b%20c", "d+e"}
+	for i, want := range expected {
+		if vals[i] != want {
+			t.Errorf("x[%d]: got %q, want %q", i, vals[i], want)
+		}
+	}
+}
+
+func TestParseQueryRawEmptyInput(t *testing.T) {
+	if got := ParseQueryRaw("", '&'); len(got) != 0 {
+		t.Errorf("expected empty map for empty input, got %v", got)
+	}
+}
+
+func TestParseQueryBothEmptyInput(t *testing.T) {
+	decoded, raw := ParseQueryBoth("", '&')
+	if len(decoded) != 0 {
+		t.Errorf("expected empty decoded map, got %v", decoded)
+	}
+	if len(raw) != 0 {
+		t.Errorf("expected empty raw map, got %v", raw)
+	}
+}
+
+func BenchmarkParseQueryBoth(b *testing.B) {
+	input := "key=%3Cscript%3E&p%61ssword=Secret%2500&plain=hello&q=hello+world"
+	for i := 0; i < b.N; i++ {
+		ParseQueryBoth(input, '&')
+	}
+}
+
+func BenchmarkParseQueryRaw(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		ParseQueryRaw(parseQueryInput, '&')
+	}
+}
diff --git a/testing/coreruleset/go.mod b/testing/coreruleset/go.mod
index b73f5f20e..239dc3fe1 100644
--- a/testing/coreruleset/go.mod
+++ b/testing/coreruleset/go.mod
@@ -51,7 +51,7 @@ require (
 	github.com/yargevad/filepathx v1.0.0 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/net v0.51.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
diff --git a/testing/coreruleset/go.sum b/testing/coreruleset/go.sum
index 7bd6ec765..6db9e3190 100644
--- a/testing/coreruleset/go.sum
+++ b/testing/coreruleset/go.sum
@@ -117,8 +117,8 @@ golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
 golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
 golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/testing/engine/args_raw.go b/testing/engine/args_raw.go
index a52eef8d6..dfae9f789 100644
--- a/testing/engine/args_raw.go
+++ b/testing/engine/args_raw.go
@@ -109,6 +109,76 @@ var _ = profile.RegisterProfile(profile.Profile{
 				},
 			},
 		},
+		{
+			Title: "ARGS_GET_NAMES_RAW preserves URL-encoded GET argument names",
+			Stages: []profile.Stage{
+				{
+					Stage: profile.SubStage{
+						Input: profile.StageInput{
+							URI:    "/index.php?p%61ram=value&other=hello",
+							Method: "GET",
+						},
+						Output: profile.ExpectedOutput{
+							TriggeredRules: []int{
+								500, // ARGS_GET_NAMES_RAW matches raw name p%61ram
+								501, // ARGS_GET_NAMES matches decoded name param
+							},
+							NonTriggeredRules: []int{
+								502, // ARGS_GET_NAMES_RAW does NOT match decoded "param"
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			Title: "ARGS_POST_NAMES_RAW preserves URL-encoded POST argument names",
+			Stages: []profile.Stage{
+				{
+					Stage: profile.SubStage{
+						Input: profile.StageInput{
+							URI:    "/index.php",
+							Method: "POST",
+							Headers: map[string]string{
+								"content-type": "application/x-www-form-urlencoded",
+							},
+							Data: "p%61ssword=secret&user=admin",
+						},
+						Output: profile.ExpectedOutput{
+							TriggeredRules: []int{
+								600, // ARGS_POST_NAMES_RAW matches raw name p%61ssword
+								601, // ARGS_POST_NAMES matches decoded name password
+							},
+							NonTriggeredRules: []int{
+								602, // ARGS_POST_NAMES_RAW does NOT match decoded "password"
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			Title: "ARGS_GET_RAW handles multiple values for the same key",
+			Stages: []profile.Stage{
+				{
+					Stage: profile.SubStage{
+						Input: profile.StageInput{
+							URI:    "/index.php?color=red&color=gr%65en&color=blue",
+							Method: "GET",
+						},
+						Output: profile.ExpectedOutput{
+							TriggeredRules: []int{
+								700, // ARGS_GET_RAW:color matches "gr%65en" (raw, second value)
+								701, // ARGS_GET:color matches "green" (decoded second value)
+							},
+							NonTriggeredRules: []int{
+								702, // ARGS_GET_RAW:color does NOT match decoded "green"
+							},
+						},
+					},
+				},
+			},
+		},
 	},
 	Rules: `
 SecRequestBodyAccess On
@@ -134,5 +204,20 @@ SecRule ARGS_NAMES_RAW "@streq param" "id:302,phase:1,pass,log"
 SecRule ARGS_GET_RAW:q "@rx \+" "id:400,phase:1,pass,log"
 SecRule ARGS_GET:q "@rx hello world" "id:401,phase:1,pass,log"
 SecRule ARGS_GET_RAW:q "@rx hello world" "id:402,phase:1,pass,log"
+
+# Test 5: ARGS_GET_NAMES_RAW preserves raw GET argument names
+SecRule ARGS_GET_NAMES_RAW "@contains p%61ram" "id:500,phase:1,pass,log"
+SecRule ARGS_GET_NAMES "@streq param" "id:501,phase:1,pass,log"
+SecRule ARGS_GET_NAMES_RAW "@streq param" "id:502,phase:1,pass,log"
+
+# Test 6: ARGS_POST_NAMES_RAW preserves raw POST argument names
+SecRule ARGS_POST_NAMES_RAW "@contains p%61ssword" "id:600,phase:2,pass,log"
+SecRule ARGS_POST_NAMES "@streq password" "id:601,phase:2,pass,log"
+SecRule ARGS_POST_NAMES_RAW "@streq password" "id:602,phase:2,pass,log"
+
+# Test 7: ARGS_GET_RAW handles multiple values for the same key
+SecRule ARGS_GET_RAW:color "@contains gr%65en" "id:700,phase:1,pass,log"
+SecRule ARGS_GET:color "@contains green" "id:701,phase:1,pass,log"
+SecRule ARGS_GET_RAW:color "@streq green" "id:702,phase:1,pass,log"
 `,
 })