FormFilter is matching encoded values against decoded values

[rworsnop]

This seems to be a bug in the class added as part of #3094.

Map<String, String[]> form = request.getParameterMap();
String queryString = request.getQueryString();

The first line gets decoded values; the second one does not.

So in the code further down that figures out whether something is a query param or not, it fails to correctly match the "form" parameter against a query parameter and then duplicates the query parameter in the form.

Downstream services will see this duplication. A Spring Web service using @RequestParam will see the parameter set to "foo,foo" instead of the expected "foo".