Fragment should be expanded last

Closes gh-22447

Author: rstoyanchev

spring-web/src/main/java/org/springframework/web/util/HierarchicalUriComponents.java

@@ -420,13 +420,15 @@ protected HierarchicalUriComponents expandInternal(UriTemplateVariables uriVaria
 		Assert.state(!this.encodeState.equals(EncodeState.FULLY_ENCODED),
 				"URI components already encoded, and could not possibly contain '{' or '}'.");
 
+		// Array-based vars rely on the below order..
+
 		String schemeTo = expandUriComponent(getScheme(), uriVariables, this.variableEncoder);
-		String fragmentTo = expandUriComponent(getFragment(), uriVariables, this.variableEncoder);
 		String userInfoTo = expandUriComponent(this.userInfo, uriVariables, this.variableEncoder);
 		String hostTo = expandUriComponent(this.host, uriVariables, this.variableEncoder);
 		String portTo = expandUriComponent(this.port, uriVariables, this.variableEncoder);
 		PathComponent pathTo = this.path.expand(uriVariables, this.variableEncoder);
 		MultiValueMap<String, String> queryParamsTo = expandQueryParams(uriVariables);
+		String fragmentTo = expandUriComponent(getFragment(), uriVariables, this.variableEncoder);
 
 		return new HierarchicalUriComponents(schemeTo, fragmentTo, userInfoTo,
 				hostTo, portTo, pathTo, queryParamsTo, this.encodeState, this.variableEncoder);

spring-web/src/test/java/org/springframework/web/util/UriComponentsTests.java

@@ -130,6 +130,15 @@ public void uirTemplateExpandWithMismatchedCurlyBraces() {
 				UriComponentsBuilder.fromUriString("/myurl/?q={{{{").encode().build().toUriString());
 	}
 
+	@Test // gh-22447
+	public void expandWithFragmentOrder() {
+		UriComponents uriComponents = UriComponentsBuilder
+				.fromUriString("http://{host}/{path}#{fragment}").build()
+				.expand("example.com", "foo", "bar");
+
+		assertEquals("http://example.com/foo#bar", uriComponents.toUriString());
+	}
+
 	@Test // SPR-12123
 	public void port() {
 		UriComponents uri1 = fromUriString("http://example.com:8080/bar").build();