fix: url-encode OAuth2 query parameters in Android, Apple and Unity

[ChiragAgg5k]

Query values were joined raw, so &, +, # or = inside a value (the OAuth2 state, a success URL with a query or fragment) split, decoded to a space or truncated the value.

// Android: createOAuth2Session / createOAuth2Token
- apiQuery.add("${it.key}=${it.value.toString()}")
+ apiQuery.add("${Uri.encode(it.key)}=${Uri.encode(it.value.toString())}")

// Apple + Swift: parametersToQueryString (OAuth2 and GET)
- output += "\(element.key)=\(element.value!)"
- return output.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)  // keeps & = #
+ output.append("\(encode(key))=\(encode(value!))")  // RFC 3986 unreserved only
+ return output.joined(separator: "&")

// Unity + .NET: ToQueryString (OAuth2 and GET)
- query.Add($"{kvp.Key}={kvp.Value.ToString()}");
- return Uri.EscapeUriString(string.Join("&", query));
+ query.Add($"{Uri.EscapeDataString(kvp.Key)}={Uri.EscapeDataString(kvp.Value.ToString() ?? string.Empty)}");
+ return string.Join("&", query);

Test: new general.getQuery mock endpoint rejects anything but value=a&b+c#d=e%f and values=[a&b, c+d#e]; shared line GET:/v1/mock/tests/general/query:passed added to Apple, Swift, .NET and Unity, the SDKs whose GET path goes through the changed functions. DotNet90 seen red on main's template and green with the fix. The Android OAuth2 URL is only built behind a browser redirect, which the e2e runner cannot drive, so Android has no e2e line for it.

Closes #2019

[hansi-codes]

🟢 Tier S · Ready to merge

The array-key adjustment preserves the existing key[] wire convention while ensuring the full key is safely encoded.

The SDK templates encode query parameter names and values for Android OAuth redirects, Swift/Apple requests, and .NET/Unity requests. The PR adds a mock endpoint and e2e coverage for reserved characters in scalar and array query values across the applicable SDKs.

Latest changes: The newest commits also percent-encode the Swift and Apple array parameter suffix ([]) together with the key.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 9

File	Change
templates/android/library/src/main/java/io/package/services/Service.kt.twig	Encodes OAuth query parameter keys and values before building redirect URLs.
templates/apple/Sources/Client.swift.twig; templates/swift/Sources/Client.swift.twig	Encodes query keys and values individually, including the array-key suffix, before joining query pairs.
templates/dotnet/Package/Extensions/Extensions.cs.twig	Encodes .NET and Unity query parameter keys and values individually.
mock-server/app/http.php; tests/resources/spec-openapi3.json	Adds a mock query operation that validates reserved characters in scalar and array values.
tests/e2e/Base.php; tests/e2e/AppleSwift61Test.php; tests/e2e/Swift61Test.php; tests/e2e/DotNet60Test.php; tests/e2e/DotNet80Test.php; tests/e2e/DotNet90Test.php; tests/e2e/Unity2021Test.php	Adds expected output for the new query-encoding case to the applicable SDK e2e suites.
tests/e2e/languages/apple/Tests.swift; tests/e2e/languages/swift/Tests.swift; tests/e2e/languages/dotnet/Tests.cs; tests/e2e/languages/unity/Tests.cs	Exercises the new mock query operation with reserved characters in scalar and array values.
mock-server/app/http.php	Adds a mock endpoint that validates scalar and array query values containing reserved characters.
tests/resources/spec-openapi3.json	Adds the query-encoding operation to the shared e2e fixture.
tests/e2e/Base.php	Defines the expected output for the new query-encoding case.

---

_{Reviewed the commits since 941e696 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary