[@polka/url] Incorrect query params parsing when param contains encoded "&"

[hoangvvo]

Consider the url below:

/?url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DeVTXPUF4Oz4%26list%3DPLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6"

@polka/url parse the above into:

{
  url: 'https://www.youtube.com/watch?v=eVTXPUF4Oz4',
  list: 'PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6'
}

which is incorrect.

Reproduction

const parser = require("@polka/url");
const querystring = require("querystring");

const url = `/?url=${encodeURIComponent(
  "https://www.youtube.com/watch?v=eVTXPUF4Oz4&list=PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6"
)}`;

console.log(parser({ url }, true)?.query);
// {
//   url: 'https://www.youtube.com/watch?v=eVTXPUF4Oz4',
//   list: 'PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK6'
// }

const queryparamsstr = url.substring(url.indexOf("?") + 1);
console.log(querystring.parse(queryparamsstr));
// [Object: null prototype] {
//   url: 'https://www.youtube.com/watch?v=eVTXPUF4Oz4&list=PLlqZM4covn1G3hqrvNwpRy19pGDTYkUK'
// }

[hoangvvo]

polka/packages/url/index.js

Line 32 in 3b4d866

try { nxt = decodeURIComponent(url) } catch (e) {/* bad */}

This line decode the url too early causing the encoded & to turn into a param separator.

[istarkov]

Also incorrect query param parsing if param contains +
i.e '?prop=a+b' must be parsed as { prop: 'a b'}