[Bug] Listener does not accept '?' and '&' in the URLs section

Prerequisite

[x] I have read the README
[x] I have search the opened & closed issues
[x] I have search the WIKI and its FAQ page
Environment Data
Merlin Version: 1.1.0
Merlin Build: nonrelease
Go Version: go1.13.8 linux/amd64
GOPATH Environment Variable: /go (Docker container build)
GOROOT Environment Variable: /usr/local/go (Docker container build)
Operating System: Ubuntu 20.04 (reproduced on Kali 2021v2) | Docker container linux 5.11.0.25-generic

Expected Behavior

I create an agent with an embedded URL of "/news.php?cmd=whoami" and/or "/news.php&cmd=whoami"

I run the HTTP listener with the correct configs (PSK, URLS)

I run the agent on the host and get a check-in.

Actual Behavior

The agent does not check-in. Confirm in Wireshark that the web request is POSTing to the correct URL, but agent authentication does not occur.

Steps to Reproduce Behavior

Compile an agent with the -X main.url flag set to /news.php?cmd=whoami Set up and run the Listener with the URLS field set to /news.php?cmd=whoami Run the agent on the target, check-in does not occur.

Compile an agent with the -X main.url flag set to /news.php&cmd=whoami Set up and run the Listener with the URLS field set to /news.php&cmd=whoami Run the agent on the target, check-in does not occur.

Compile an agent with the -X main.url flag set to /news.phpcmd=whoami Set up and run the Listener with the URLS field set to /news.phpcmd=whoami Run the agent on the target, check-in does occur.

Misc Information

May exist with other special chars as well, confirmed for & and ?. = seems to be OK and does not hinder check-in.

PCAP for failing check-in

PCAP for successful check-in

Ne0nd0g / merlin