fix: sort query parameter names by UTF-16 code unit#130
Merged
Conversation
QueryParametersBuilder.sort() combined surrogate pairs into code points before comparing names, so every supplementary-plane character sorted after every BMP character. The WHATWG URL spec defines URLSearchParams.sort() over raw UTF-16 code units instead, where a supplementary name's leading surrogate can sort below a BMP character and reverse that ordering. Compare with plain String.compareTo to match observed browser/Node behavior, and add the WPT urlsearchparams-sort ligature/rainbow vector plus the code-unit reproduction as regression tests. Closes #87
CONF-103 in the §13 conformance list still described sort() as code-point (surrogate-aware) ordering, the exact behavior QUERY-18 was just corrected away from. Update CONF-103 and its Appendix A index row to state the same UTF-16 code-unit order as QUERY-18, and refresh the three sort() test comments that still described the removed manual code-point scan.
This was referenced Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
QueryParametersBuilder.sort()combined UTF-16 surrogate pairs into code points before comparing parameter names, so every supplementary-plane name (any character above U+FFFF) sorted after every BMP name.URLSearchParams.sort()over raw UTF-16 code units, not code points, and under code-unit order a supplementary name's leading surrogate can sort below a BMP character, reversing that relative order.String.compareTo(no surrogate decoding) and updated the SPEC.md[QUERY-18]wording to match; removed the now-unused code-point comparison helper.Test plan
urlsearchparams-sortvector cited in the issue (U+FB03ffivs U+1F308🌈), confirmed order reverses from code-point order.😀vs U+FFFF�) by updating the existing test that had encoded the old (incorrect) code-point-order expectation../gradlew :kuri:jvmTest :kuri:ktlintCheck :kuri:detekt./gradlew :kuri:jsNodeTest(commonMain touched)./gradlew :kuri:macosArm64Test(native target compiles and passes)./gradlew :kuri:apiCheck— not runnable in this environment (androidApiBuildfails on missingANDROID_HOME; confirmed this is pre-existing onorigin/maintoo, unrelated to this change). No public API changed (sort()signature is unchanged; only a private helper was removed), so noapiDumpregeneration is needed.Closes #87