Patched code sample

import urllib.parse


def fixed_querystring_parser(body: bytes) -> dict:
    """
    Represents the fixed parser. It correctly parses an
    application/x-www-form-urlencoded body by treating only '&' as a field
    separator, adhering to the WHATWG standard. Semicolons are now
    correctly treated as part of the value.
    """
    fields = {}
    # The core of the fix: The string is split *only* by b"&".
    # The vulnerable version would also split by b";".
    for pair in body.split(b"&"):
        if b"=" in pair:
            key, value = pair.split(b"=", 1)
            # Use urllib.parse for proper decoding of URL-encoded values.
            key_str = urllib.parse.unquote_plus(key.decode("latin-1"))
            value_str = urllib.parse.unquote_plus(value.decode("latin-1"))
            fields[key_str] = value_str
    return fields


# A payload that would be vulnerable to the old parser.
# The old parser would see two fields: 'user' and 'role'.
malicious_payload = b"user=guest;role=admin"

# Using the fixed parser, the semicolon is treated as part of the value.
# The 'role=admin' field is not injected.
parsed_data = fixed_querystring_parser(malicious_payload)

# This will print: {'user': 'guest;role=admin'}
# This demonstrates that the smuggled 'role' field was not created.
print(parsed_data)