fix: double encoding of array parameters in signature base

lib/oauth1/helper.rb

@@ -26,9 +26,28 @@ def initialize(method, url, params, options)
 
     def signature_base
       @url_params.delete(:oauth_signature)
-      [@method, @url.to_s, url_with_params.query].map{|v| CGI.escape(v) }.join('&')
+
+      # Convert parameters to array of [key, value] pairs
+      pairs = @url_params.flat_map do |key, value|
+        if value.is_a?(Array)
+          # For arrays, create multiple pairs with the same key
+          value.map { |v| [key.to_s, v.to_s] }
+        else
+          [[key.to_s, value.to_s]]
+        end
+      end
+
+      # Sort first by key, then by value
+      normalized_params = pairs.sort.map { |k, v| "#{escape(k)}=#{escape(v)}" }.join('&')
+
+      # Create base string
+      [@method, escape(@url.to_s), escape(normalized_params)].join('&')
     end
 
+    # Use a single consistent escaping method
+    def escape(value)
+      CGI.escape(value.to_s).gsub('+', '%20')
+    end
 
     def full_url
       append_signature_to_params

spec/oauth1/helper_spec.rb

@@ -53,6 +53,52 @@
       expect(signature_base).to match(/oauth_consumer_key/)
       expect(signature_base).to match(/user_specified_param/)
     end
+
+    context 'with array parameters' do
+      let(:array_params) { {user_specified_param: 'params', tags: ['ruby', 'rails']} }
+      let(:array_helper) { OAuth1::Helper.new(:get, url, array_params, {consumer_key: consumer_key, consumer_secret: consumer_secret}) }
+      let(:array_signature_base) { array_helper.signature_base }
+
+      it 'handles array parameters correctly' do
+        expect(array_signature_base).to include('tags%3Druby')
+        expect(array_signature_base).to include('tags%3Drails')
+      end
+
+      it 'properly escapes each parameter only once' do
+        expect(array_signature_base).to match(/tags%3Druby/)
+        expect(array_signature_base).to match(/tags%3Drails/)
+      end
+    end
+
+    context 'with parameters containing special characters' do
+      let(:special_params) { {query: 'space test', tags: ['special!@#$']} }
+      let(:special_helper) { OAuth1::Helper.new(:get, url, special_params, {consumer_key: consumer_key, consumer_secret: consumer_secret}) }
+      let(:special_signature_base) { special_helper.signature_base }
+
+      it 'properly escapes special characters' do
+        expect(special_signature_base).to match(/query%3Dspace%2520test/)
+      end
+
+      it 'properly escapes special characters in array values' do
+        expect(special_signature_base).to match(/tags%3Dspecial%2521%2540%2523%2524/)
+      end
+    end
+
+    context 'with array parameter keys containing brackets' do
+      let(:bracket_params) { {'tags[]' => ['ruby', 'rails']} }
+      let(:bracket_helper) { OAuth1::Helper.new(:get, url, bracket_params, {consumer_key: consumer_key, consumer_secret: consumer_secret}) }
+      let(:bracket_signature_base) { bracket_helper.signature_base }
+
+      it 'escapes the brackets in parameter keys' do
+        expect(bracket_signature_base).to match(/tags%255B%255D%3Druby/)
+        expect(bracket_signature_base).to match(/tags%255B%255D%3Drails/)
+      end
+
+      it 'consistently encodes the brackets' do
+        expect(bracket_signature_base).to match(/tags%255B%255D/)
+        expect(bracket_signature_base.scan(/tags%255B%255D/).count).to eq(2)
+      end
+    end
   end
 
   describe '#full_url' do
@@ -62,5 +108,27 @@
     it { expect(full_url).to match(/oauth_signature_method=HMAC-SHA1/) }
     it { expect(full_url).to match(/oauth_signature=/) }
     it { expect(full_url).to match(/user_specified_param/) }
+
+    context 'with array parameters' do
+      let(:array_params) { {tags: ['ruby', 'rails']} }
+      let(:array_helper) { OAuth1::Helper.new(:get, url, array_params, {consumer_key: consumer_key, consumer_secret: consumer_secret}) }
+      let(:array_full_url) { array_helper.full_url }
+
+      it 'includes all array values in the URL' do
+        expect(array_full_url).to include('tags=ruby')
+        expect(array_full_url).to include('tags=rails')
+      end
+    end
+
+    context 'with array parameter keys containing brackets' do
+      let(:bracket_params) { {'tags[]' => ['ruby', 'rails']} }
+      let(:bracket_helper) { OAuth1::Helper.new(:get, url, bracket_params, {consumer_key: consumer_key, consumer_secret: consumer_secret}) }
+      let(:bracket_full_url) { bracket_helper.full_url }
+
+      it 'properly includes brackets in the URL' do
+        expect(bracket_full_url).to include('tags%5B%5D=ruby')
+        expect(bracket_full_url).to include('tags%5B%5D=rails')
+      end
+    end
   end
 end