Skip to content

[GENERAL][FIXED] - Fix WHATWG spec violations in URL and URLSearchParams polyfills#56327

Open
w3di wants to merge 1 commit intofacebook:mainfrom
w3di:fix/url-urlsearchparams-whatwg-spec
Open

[GENERAL][FIXED] - Fix WHATWG spec violations in URL and URLSearchParams polyfills#56327
w3di wants to merge 1 commit intofacebook:mainfrom
w3di:fix/url-urlsearchparams-whatwg-spec

Conversation

@w3di
Copy link
Copy Markdown

@w3di w3di commented Apr 4, 2026

Summary

Three spec violations in the URL and URLSearchParams polyfills (Libraries/Blob/):

  1. URLSearchParams.size returned the number of unique keys (Map.size) instead of the total number of name-value pairs. Per WHATWG spec, .size must return the list's total size.

  2. URLSearchParams string constructor split on every = character, silently dropping parts of values containing = (e.g. base64 tokens, JWTs). Per WHATWG spec, only the first = is the key-value separator.

  3. URL.hash getter used a regex /#([^/]*)/ that stopped matching at /, breaking fragment identifiers like #/users/123 common in SPA hash-routing. Per WHATWG spec, the hash includes everything from # to end of string.

Changelog:

[General] [Fixed] - Fix WHATWG spec violations in URL and URLSearchParams polyfills

Test Plan

  • Updated existing test: URLSearchParams constructed from array with duplicate keys now expects size to be 3 (total pairs) instead of 2 (unique keys).
  • All existing tests pass: yarn jest packages/react-native/Libraries/Blob/__tests__/URL-test.js
  • Prettier and ESLint checks pass.
  • Verified browser behavior matches the fix:
// Browser console (Chrome/Firefox/Safari):
new URLSearchParams([['a','1'],['a','2'],['b','3']]).size // 3
new URLSearchParams('token=abc=def').get('token')         // 'abc=def'
new URL('https://example.com/#/users/123').hash           // '#/users/123'

…ams polyfills

Summary:
Three spec violations in the URL/URLSearchParams polyfills:

1. URLSearchParams.size returned the number of unique keys (Map.size)
   instead of the total number of name-value pairs per the WHATWG spec.

2. URLSearchParams string constructor split on every '=' character,
   dropping parts of values that contain '='. Only the first '='
   should be treated as a key-value separator.

3. URL.hash getter used a regex that stopped at '/', breaking
   fragment identifiers like #/users/123 common in SPA routing.
@meta-cla meta-cla bot added the CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. label Apr 4, 2026
@facebook-github-tools facebook-github-tools bot added the Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team. label Apr 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. Shared with Meta Applied via automation to indicate that an Issue or Pull Request has been shared with the team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant