TYPO3 Core

cHash calculation is fine, but your Typoscript example has the bug. You should check in TS if QUERY_STRING is empty.

Yes sure it's a bug in the example Typoscript the correct way would be to write it this way:
additionalParams = &{getIndpEnv : QUERY_STRING}
additionalParams {
insertData = 1
if.isTrue.data = getIndpEnv : QUERY_STRING
}

The patch just prevents the possible error in Typoscript.

bug_12322.diff is the correct patch

One cannot prevent all possible misconfigurations in typoscript. So your patch just blows up the core without gaining much effect.
Since we agree it is a misconfiguration in Typoscript, I plead for closing this bug.

I think such typoscript errors exists on many sites. If you have such an error on a big site is hard to locate it. The only hint is "the incoming cHash "xxxx" and calculated cHash "xxx" did not match" in the admin panel.

For me it's not a blow up but rather a small improvement that prevents possible caching problems with RealURL.

An other problem occurs if you have the following typoscript setup:
10 = TEXT
10 {
typolink {
parameter.data = TSFE:id
additionalParams.dataWrap = &tx_testext_pi1[showUid]={field:uid}

}
}

If uid is empty t3lib_div::cHashParams returns a array with an empty value. And the cHash does not match again.

Nobody prevents you from sending an RFC to the core list and try to get it into the core:
http://typo3.org/teams/core/core-mailinglist-rules/

I confirm the problem. I just found identical cHashes coming from the empty parameter string. They spoil RealURL cache.

rev 8187, 8188, 8189