Fix expansion of query param with same name

See gh-34783

Signed-off-by: whl <[email protected]>

Author: whlit

spring-web/src/main/java/org/springframework/web/util/HierarchicalUriComponents.java

@@ -451,7 +451,7 @@ private MultiValueMap<String, String> expandQueryParams(UriTemplateVariables var
 		UriTemplateVariables queryVariables = new QueryUriTemplateVariables(variables);
 		this.queryParams.forEach((key, values) -> {
 			String name = expandUriComponent(key, queryVariables, this.variableEncoder);
-			List<String> expandedValues = new ArrayList<>(values.size());
+			List<String> expandedValues = result.getOrDefault(name, new ArrayList<>(values.size()));
 			for (String value : values) {
 				expandedValues.add(expandUriComponent(value, queryVariables, this.variableEncoder));
 			}

spring-web/src/test/java/org/springframework/web/util/UriComponentsBuilderTests.java

@@ -629,6 +629,20 @@ void parseBuildAndExpandHierarchical(ParserType parserType) {
 		assertThat(uri.toString()).isEqualTo("ws://example.org:7777/path?q=1#foo");
 	}
 
+	@ParameterizedTest
+	@EnumSource
+	void parseBuildAndExpandHierarchicalWithDuplicateQueryKeys(ParserType parserType) {
+		UriComponents result = UriComponentsBuilder.fromUriString("/?{pk1}={pv1}&{pk2}={pv2}", parserType)
+				.buildAndExpand("k1", "v1", "k1", "v2");
+		assertThat(result.getQuery()).isEqualTo("k1=v1&k1=v2");
+		assertThat(result.getQueryParams().get("k1")).containsExactly("v1", "v2");
+
+		UriComponents result2 = UriComponentsBuilder.fromUriString("/?{pk1}={pv1}&{pk2}={pv2}", parserType)
+				.buildAndExpand(Map.of("pk1", "k1", "pv1", "v1", "pk2", "k1", "pv2", "v2"));
+		assertThat(result2.getQuery()).isEqualTo("k1=v1&k1=v2");
+		assertThat(result.getQueryParams().get("k1")).containsExactly("v1", "v2");
+	}
+
 	@ParameterizedTest
 	@EnumSource
 	void buildAndExpandOpaque(ParserType parserType) {