HttpServerRequest supports query parameters.

reactor-netty-http/build.gradle

@@ -250,6 +250,7 @@ task japicmp(type: JapicmpTask) {
 
 	compatibilityChangeExcludes = [ "METHOD_NEW_DEFAULT" ]
 	methodExcludes = [
+		'reactor.netty.http.server.HttpServerRequest#queryParams()'
 	]
 }
 

reactor-netty-http/src/main/java/reactor/netty/http/HttpOperations.java

@@ -17,6 +17,8 @@
 
 import java.net.URI;
 import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.concurrent.Callable;
 import java.util.concurrent.atomic.AtomicIntegerFieldUpdater;
@@ -228,6 +230,10 @@ protected HttpMessageLogFactory httpMessageLogFactory() {
 
 	protected abstract void beforeMarkSentHeaders();
 
+	protected Map<String, List<String>> parseQueryParams(String uri) {
+		return QueryStringDecoder.decodeParams(uri);
+	}
+
 	protected abstract void afterMarkSentHeaders();
 
 	protected abstract boolean isContentAlwaysEmpty();

reactor-netty-http/src/main/java/reactor/netty/http/QueryStringDecoder.java

@@ -0,0 +1,203 @@
+/*
+ * Copyright (c) 2012-2023 VMware, Inc. or its affiliates, All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package reactor.netty.http;
+
+import static io.netty.util.internal.StringUtil.EMPTY_STRING;
+import static io.netty.util.internal.StringUtil.SPACE;
+import static io.netty.util.internal.StringUtil.decodeHexByte;
+
+import io.netty.handler.codec.http.HttpConstants;
+import io.netty.util.internal.PlatformDependent;
+
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+
+/**
+ * Provides utility methods to split an HTTP query string into key-value parameter pairs.
+ * <pre>
+ * {@link Map} parameters = {@link QueryStringDecoder}.decodeParams("/hello?recipient=world&x=1;y=2");
+ * assert parameters.get("recipient").get(0).equals("world");
+ * assert parameters.get.get("x").get(0).equals("1");
+ * assert parameters.get.get("y").get(0).equals("2");
+ * </pre>
+ *
+ *
+ * <h3>HashDOS vulnerability fix</h3>
+ *
+ * As a workaround to the <a href="https://netty.io/s/hashdos">HashDOS</a> vulnerability, the decoder
+ * limits the maximum number of decoded key-value parameter pairs, up to {@literal 1024} by
+ * default. you can configure it when you construct the decoder by passing an additional
+ * integer parameter.
+ *
+ */
+public class QueryStringDecoder {
+
+    private static final int DEFAULT_MAX_PARAMS = 1024;
+
+	public static Map<String, List<String>> decodeParams(final String uri) {
+
+		return decodeParams(uri, HttpConstants.DEFAULT_CHARSET,
+				DEFAULT_MAX_PARAMS, true);
+	}
+
+	public static Map<String, List<String>> decodeParams(final String uri, final boolean semiColonIsNormalChar) {
+
+		return decodeParams(uri, HttpConstants.DEFAULT_CHARSET,
+				DEFAULT_MAX_PARAMS, semiColonIsNormalChar);
+	}
+
+	public static Map<String, List<String>> decodeParams(final String uri, final Charset charset, final int maxParams, final boolean semicolonIsNormalChar) {
+		Objects.requireNonNull(uri, "uri");
+		Objects.requireNonNull(charset, "charset");
+		if (maxParams < 1) {
+			throw new IllegalArgumentException("maxParams must be positive");
+		}
+
+		int from = findPathEndIndex(uri);
+		return decodeParams(uri, from, charset,
+				maxParams, semicolonIsNormalChar);
+	}
+
+    private static Map<String, List<String>> decodeParams(String s, int from, Charset charset, int paramsLimit,
+                                                          boolean semicolonIsNormalChar) {
+        int len = s.length();
+        if (from >= len) {
+            return Collections.emptyMap();
+        }
+        if (s.charAt(from) == '?') {
+            from++;
+        }
+        Map<String, List<String>> params = new LinkedHashMap<String, List<String>>();
+        int nameStart = from;
+        int valueStart = -1;
+        int i;
+        loop:
+        for (i = from; i < len; i++) {
+            switch (s.charAt(i)) {
+            case '=':
+                if (nameStart == i) {
+                    nameStart = i + 1;
+                }
+				else if (valueStart < nameStart) {
+                    valueStart = i + 1;
+                }
+                break;
+            case ';':
+                if (semicolonIsNormalChar) {
+                    continue;
+                }
+                // fall-through
+            case '&':
+                if (addParam(s, nameStart, valueStart, i, params, charset)) {
+                    paramsLimit--;
+                    if (paramsLimit == 0) {
+                        return params;
+                    }
+                }
+                nameStart = i + 1;
+                break;
+            case '#':
+                break loop;
+            default:
+                // continue
+            }
+        }
+        addParam(s, nameStart, valueStart, i, params, charset);
+        return params;
+    }
+
+    private static boolean addParam(String s, int nameStart, int valueStart, int valueEnd,
+                                    Map<String, List<String>> params, Charset charset) {
+        if (nameStart >= valueEnd) {
+            return false;
+        }
+        if (valueStart <= nameStart) {
+            valueStart = valueEnd + 1;
+        }
+        String name = decodeComponent(s, nameStart, valueStart - 1, charset, false);
+        String value = decodeComponent(s, valueStart, valueEnd, charset, false);
+        List<String> values = params.get(name);
+        if (values == null) {
+            values = new ArrayList<String>(1);  // Often there's only 1 value.
+            params.put(name, values);
+        }
+        values.add(value);
+        return true;
+    }
+
+    private static String decodeComponent(String s, int from, int toExcluded, Charset charset, boolean isPath) {
+        int len = toExcluded - from;
+        if (len <= 0) {
+            return EMPTY_STRING;
+        }
+        int firstEscaped = -1;
+        for (int i = from; i < toExcluded; i++) {
+            char c = s.charAt(i);
+            if (c == '%' || c == '+' && !isPath) {
+                firstEscaped = i;
+                break;
+            }
+        }
+        if (firstEscaped == -1) {
+            return s.substring(from, toExcluded);
+        }
+
+        // Each encoded byte takes 3 characters (e.g. "%20")
+        int decodedCapacity = (toExcluded - firstEscaped) / 3;
+        byte[] buf = PlatformDependent.allocateUninitializedArray(decodedCapacity);
+        int bufIdx;
+
+        StringBuilder strBuf = new StringBuilder(len);
+        strBuf.append(s, from, firstEscaped);
+
+        for (int i = firstEscaped; i < toExcluded; i++) {
+            char c = s.charAt(i);
+            if (c != '%') {
+                strBuf.append(c != '+' || isPath ? c : SPACE);
+                continue;
+            }
+
+            bufIdx = 0;
+            do {
+                if (i + 3 > toExcluded) {
+                    throw new IllegalArgumentException("unterminated escape sequence at index " + i + " of: " + s);
+                }
+                buf[bufIdx++] = decodeHexByte(s, i + 1);
+                i += 3;
+            } while (i < toExcluded && s.charAt(i) == '%');
+            i--;
+
+            strBuf.append(new String(buf, 0, bufIdx, charset));
+        }
+        return strBuf.toString();
+    }
+
+    private static int findPathEndIndex(String uri) {
+        int len = uri.length();
+        for (int i = 0; i < len; i++) {
+            char c = uri.charAt(i);
+            if (c == '?' || c == '#') {
+                return i;
+            }
+        }
+        return len;
+    }
+}

reactor-netty-http/src/main/java/reactor/netty/http/server/HttpServerOperations.java

@@ -22,6 +22,7 @@
 import java.nio.file.Path;
 import java.time.Duration;
 import java.time.ZonedDateTime;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
@@ -128,6 +129,7 @@ class HttpServerOperations extends HttpOperations<HttpServerRequest, HttpServerR
 	final String scheme;
 	final ZonedDateTime timestamp;
 
+	Map<String, List<String>> queryParamsMap;
 	BiPredicate<HttpServerRequest, HttpServerResponse> compressionPredicate;
 	Function<? super String, Map<String, String>> paramsResolver;
 	String path;
@@ -479,6 +481,14 @@ public HttpHeaders requestHeaders() {
 		throw new IllegalStateException("request not parsed");
 	}
 
+	@Override
+	public Map<String, List<String>> queryParams() {
+		if (queryParamsMap == null) {
+			queryParamsMap = Collections.unmodifiableMap(parseQueryParams(this.nettyRequest.uri()));
+		}
+		return queryParamsMap;
+	}
+
 	@Override
 	public String scheme() {
 		return this.connectionInfo.getScheme();

reactor-netty-http/src/main/java/reactor/netty/http/server/HttpServerRequest.java

@@ -17,6 +17,7 @@
 
 import java.net.InetSocketAddress;
 import java.time.ZonedDateTime;
+import java.util.List;
 import java.util.Map;
 import java.util.function.Consumer;
 import java.util.function.Function;
@@ -143,6 +144,14 @@ default Flux<HttpContent> receiveContent() {
 	 */
 	HttpHeaders requestHeaders();
 
+	/**
+	 * return parsed and decoded query parameter name value pairs
+	 *
+	 * @return query parameters {@link Map}
+	 * @since 1.1.6
+	 */
+	Map<String, List<String>> queryParams();
+
 	/**
 	 * Returns the inbound protocol and version.
 	 *