test: expand coverage for raw argument collections

go.sum

@@ -75,8 +75,6 @@ golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
 golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

internal/bodyprocessors/multipart_test.go

@@ -330,3 +330,43 @@ text defa`)
 		t.Fatalf("expected ArgsPost 'text' to be 'text defa', got %q", textValues[0])
 	}
 }
+
+func TestMultipartArgsPostRaw(t *testing.T) {
+	// For multipart, field values are not URL-encoded, so ArgsPostRaw should equal ArgsPost.
+	payload := strings.TrimSpace(`
+-----------------------------9051914041544843365972754266
+Content-Disposition: form-data; name="username"
+
+john_doe
+-----------------------------9051914041544843365972754266
+Content-Disposition: form-data; name="comment"
+
+hello world
+-----------------------------9051914041544843365972754266--
+`)
+
+	mp := multipartProcessor(t)
+	v := corazawaf.NewTransactionVariables()
+	if err := mp.ProcessRequest(strings.NewReader(payload), v, plugintypes.BodyProcessorOptions{
+		Mime: "multipart/form-data; boundary=---------------------------9051914041544843365972754266",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// ArgsPost and ArgsPostRaw should both contain the field values (raw == cooked for multipart).
+	argsPost := v.ArgsPost()
+	argsPostRaw := v.ArgsPostRaw()
+
+	fields := map[string]string{
+		"username": "john_doe",
+		"comment":  "hello world",
+	}
+	for field, want := range fields {
+		if got := argsPost.Get(field); len(got) == 0 || got[0] != want {
+			t.Errorf("ArgsPost[%q]: got %v, want %q", field, got, want)
+		}
+		if got := argsPostRaw.Get(field); len(got) == 0 || got[0] != want {
+			t.Errorf("ArgsPostRaw[%q]: got %v, want %q", field, got, want)
+		}
+	}
+}

internal/bodyprocessors/urlencoded_test.go

@@ -13,6 +13,66 @@ import (
 	"github.com/corazawaf/coraza/v3/internal/corazawaf"
 )
 
+func TestURLEncodeRawValues(t *testing.T) {
+	bp, err := bodyprocessors.GetBodyProcessor("urlencoded")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name         string
+		body         string
+		wantCooked   map[string]string // decoded value in ArgsPost
+		wantRaw      map[string]string // raw value in ArgsPostRaw
+	}{
+		{
+			name:       "percent-encoded value",
+			body:       "key=%3Cscript%3E",
+			wantCooked: map[string]string{"key": "<script>"},
+			wantRaw:    map[string]string{"key": "%3Cscript%3E"},
+		},
+		{
+			name:       "double-encoded value",
+			body:       "password=Secret%2500",
+			wantCooked: map[string]string{"password": "Secret%00"},
+			wantRaw:    map[string]string{"password": "Secret%2500"},
+		},
+		{
+			name:       "plus sign preserved in raw",
+			body:       "q=hello+world",
+			wantCooked: map[string]string{"q": "hello world"},
+			wantRaw:    map[string]string{"q": "hello+world"},
+		},
+		{
+			name:       "plain value identical in both",
+			body:       "plain=hello",
+			wantCooked: map[string]string{"plain": "hello"},
+			wantRaw:    map[string]string{"plain": "hello"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			v := corazawaf.NewTransactionVariables()
+			if err := bp.ProcessRequest(strings.NewReader(tc.body), v, plugintypes.BodyProcessorOptions{}); err != nil {
+				t.Fatal(err)
+			}
+			for k, want := range tc.wantCooked {
+				got := v.ArgsPost().Get(k)
+				if len(got) == 0 || got[0] != want {
+					t.Errorf("ArgsPost[%q]: got %v, want %q", k, got, want)
+				}
+			}
+			for k, want := range tc.wantRaw {
+				got := v.ArgsPostRaw().Get(k)
+				if len(got) == 0 || got[0] != want {
+					t.Errorf("ArgsPostRaw[%q]: got %v, want %q", k, got, want)
+				}
+			}
+		})
+	}
+}
+
 func TestURLEncode(t *testing.T) {
 	bp, err := bodyprocessors.GetBodyProcessor("urlencoded")
 	if err != nil {

internal/corazawaf/transaction_test.go

@@ -1712,6 +1712,129 @@ func TestAddResponseArgsWithOverlimit(t *testing.T) {
 	}
 }
 
+func TestExtractGetArgumentsRaw(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("key=%3Cscript%3E&plain=hello&p%61ram=value")
+
+	// Decoded values in argsGet
+	if v := tx.variables.argsGet.Get("key"); len(v) == 0 || v[0] != "<script>" {
+		t.Errorf("argsGet key: got %v, want [<script>]", v)
+	}
+	if v := tx.variables.argsGet.Get("plain"); len(v) == 0 || v[0] != "hello" {
+		t.Errorf("argsGet plain: got %v, want [hello]", v)
+	}
+	if v := tx.variables.argsGet.Get("param"); len(v) == 0 || v[0] != "value" {
+		t.Errorf("argsGet param (decoded key): got %v, want [value]", v)
+	}
+
+	// Raw values in argsGetRaw — percent-encoding preserved
+	if v := tx.variables.argsGetRaw.Get("key"); len(v) == 0 || v[0] != "%3Cscript%3E" {
+		t.Errorf("argsGetRaw key: got %v, want [%%3Cscript%%3E]", v)
+	}
+	if v := tx.variables.argsGetRaw.Get("plain"); len(v) == 0 || v[0] != "hello" {
+		t.Errorf("argsGetRaw plain: got %v, want [hello]", v)
+	}
+	// Raw key name is also preserved
+	if v := tx.variables.argsGetRaw.Get("p%61ram"); len(v) == 0 || v[0] != "value" {
+		t.Errorf("argsGetRaw p%%61ram: got %v, want [value]", v)
+	}
+}
+
+func TestExtractGetArgumentsRawPlusSign(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("q=hello+world")
+
+	// Decoded: "+" becomes " "
+	if v := tx.variables.argsGet.Get("q"); len(v) == 0 || v[0] != "hello world" {
+		t.Errorf("argsGet q: got %v, want [hello world]", v)
+	}
+	// Raw: "+" is preserved
+	if v := tx.variables.argsGetRaw.Get("q"); len(v) == 0 || v[0] != "hello+world" {
+		t.Errorf("argsGetRaw q: got %v, want [hello+world]", v)
+	}
+}
+
+func TestExtractGetArgumentsRawDoubleEncoding(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("payload=Secret%2500")
+
+	// Decoded: %25 → % giving "Secret%00"
+	if v := tx.variables.argsGet.Get("payload"); len(v) == 0 || v[0] != "Secret%00" {
+		t.Errorf("argsGet payload: got %v, want [Secret%%00]", v)
+	}
+	// Raw: double-encoding preserved as-is
+	if v := tx.variables.argsGetRaw.Get("payload"); len(v) == 0 || v[0] != "Secret%2500" {
+		t.Errorf("argsGetRaw payload: got %v, want [Secret%%2500]", v)
+	}
+}
+
+func TestExtractGetArgumentsRawNamesCollection(t *testing.T) {
+	waf := NewWAF()
+	tx := waf.NewTransaction()
+	defer func() {
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}()
+
+	tx.ExtractGetArguments("p%61ram=value&other=hello")
+
+	// argsGetNamesRaw should contain the raw (non-decoded) key names.
+	rawNames := tx.variables.argsGetNamesRaw.FindAll()
+	found := false
+	for _, md := range rawNames {
+		if md.Value() == "p%61ram" {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("argsGetNamesRaw: expected to find 'p%%61ram', got %v", rawNames)
+	}
+}
+
+func TestAddRawGetArgsWithOverlimit(t *testing.T) {
+	testCases := []int{1, 2, 5, 1000}
+
+	for _, limit := range testCases {
+		waf := NewWAF()
+		tx := waf.NewTransaction()
+		tx.WAF.ArgumentLimit = limit
+		// Call addGetRequestArgumentRaw directly (same package) to test the limit path.
+		for i := 0; i < limit+1; i++ {
+			tx.addGetRequestArgumentRaw(fmt.Sprintf("testKey%d", i), "samplevalue")
+		}
+		if tx.variables.argsGetRaw.Len() > waf.ArgumentLimit {
+			t.Fatalf("Argument limit failed for raw GET args (limit=%d, got %d)", limit, tx.variables.argsGetRaw.Len())
+		}
+
+		if err := tx.Close(); err != nil {
+			t.Fatalf("Failed to close transaction: %s", err.Error())
+		}
+	}
+}
+
 func TestResponseBodyForceProcessing(t *testing.T) {
 	waf := NewWAF()
 	waf.ResponseBodyAccess = true

internal/url/url_test.go

@@ -149,3 +149,83 @@ func TestParseQueryBoth(t *testing.T) {
 		t.Errorf("raw plain: got %v, want [hello]", v)
 	}
 }
+
+func TestParseQueryBothPlusSigns(t *testing.T) {
+	// Plus signs: decoded as space in cooked, preserved literally in raw.
+	input := "q=hello+world&tag=foo+bar"
+	decoded, raw := ParseQueryBoth(input, '&')
+
+	if v := decoded["q"]; len(v) != 1 || v[0] != "hello world" {
+		t.Errorf("decoded q: got %v, want [hello world]", v)
+	}
+	if v := raw["q"]; len(v) != 1 || v[0] != "hello+world" {
+		t.Errorf("raw q: got %v, want [hello+world]", v)
+	}
+	if v := decoded["tag"]; len(v) != 1 || v[0] != "foo bar" {
+		t.Errorf("decoded tag: got %v, want [foo bar]", v)
+	}
+	if v := raw["tag"]; len(v) != 1 || v[0] != "foo+bar" {
+		t.Errorf("raw tag: got %v, want [foo+bar]", v)
+	}
+}
+
+func TestParseQueryBothMultipleValues(t *testing.T) {
+	// Multiple values for the same key.
+	input := "color=red&color=blue&color=gr%65en"
+	decoded, raw := ParseQueryBoth(input, '&')
+
+	if v := decoded["color"]; len(v) != 3 || v[0] != "red" || v[1] != "blue" || v[2] != "green" {
+		t.Errorf("decoded color: got %v, want [red blue green]", v)
+	}
+	if v := raw["color"]; len(v) != 3 || v[0] != "red" || v[1] != "blue" || v[2] != "gr%65en" {
+		t.Errorf("raw color: got %v, want [red blue gr%%65en]", v)
+	}
+}
+
+func TestParseQueryRawMultipleValues(t *testing.T) {
+	input := "x=a&x=b%20c&x=d+e"
+	got := ParseQueryRaw(input, '&')
+
+	vals, ok := got["x"]
+	if !ok {
+		t.Fatal("missing key x")
+	}
+	if len(vals) != 3 {
+		t.Fatalf("expected 3 values, got %d: %v", len(vals), vals)
+	}
+	expected := []string{"a", "b%20c", "d+e"}
+	for i, want := range expected {
+		if vals[i] != want {
+			t.Errorf("x[%d]: got %q, want %q", i, vals[i], want)
+		}
+	}
+}
+
+func TestParseQueryRawEmptyInput(t *testing.T) {
+	if got := ParseQueryRaw("", '&'); len(got) != 0 {
+		t.Errorf("expected empty map for empty input, got %v", got)
+	}
+}
+
+func TestParseQueryBothEmptyInput(t *testing.T) {
+	decoded, raw := ParseQueryBoth("", '&')
+	if len(decoded) != 0 {
+		t.Errorf("expected empty decoded map, got %v", decoded)
+	}
+	if len(raw) != 0 {
+		t.Errorf("expected empty raw map, got %v", raw)
+	}
+}
+
+func BenchmarkParseQueryBoth(b *testing.B) {
+	input := "key=%3Cscript%3E&p%61ssword=Secret%2500&plain=hello&q=hello+world"
+	for i := 0; i < b.N; i++ {
+		ParseQueryBoth(input, '&')
+	}
+}
+
+func BenchmarkParseQueryRaw(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		ParseQueryRaw(parseQueryInput, '&')
+	}
+}

testing/coreruleset/go.mod

@@ -51,7 +51,7 @@ require (
 	github.com/yargevad/filepathx v1.0.0 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/net v0.51.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
 	golang.org/x/time v0.9.0 // indirect

testing/coreruleset/go.sum

@@ -117,8 +117,8 @@ golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
 golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
 golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=