Query parameters get malformed meanwhile access checking

Problem

It seems until a route access checker gets called, a new Request gets created several times based on the raw path and because of that, special characters from query parameters get lost. So if you have an access checker that checks access based on a value of a query parameter that may contain special characters (ex.: a hash) then the access checker can return false-positive results. This probably happens because special characters in query params have not been URL encoded.

Callstack:

Proposed solution

Probably everywhere where new Request gets created from a raw path, the path should be exploded to parts and we should warrant that all query parameters get URL decoded before the new Request object is created. Ex.: \Drupal\Core\Url::toUriString()

Remaining tasks

Determine solution