anezirovic
commented
4 years ago Thanks for the report, the code was indeed problematic on many points. It should be fixed in the latest master.
Usually, I'd ask for code contribution from the reporter, but we've recently introduced code for parsing request cookies, pretty similar to this urlencode parser, but more robust when parsing single or last parameter (better match() regexes too, I guess my Lua improved)
It's extracted into generic parse_kv(payload, separator) function now, and it will used it in other places (we really need to check that multipart/form-data parsing too)
Please test.
Realized when making a request like this:
curl -v -X POST 127.0.0.1/test -H "Content-Type: application/x-www-form-urlencoded" -d "param1=value1"
That the params was empty. Turned out that the logic required an & in the body (which wouldn't exist if there was a single parameter).
Fixed by minor duplication of the part parsing: if the body had no ampersand the break caused it to exit before parsing any arguments, as well as caused it to ignore the last argument.