Invalid pattern allows to parse invalid queries

[GitSparTV]

neturl/lib/net/url.lua

Line 210 in de6e3dc

for key,val in str:gmatch(string.format('([^%q=]+)(=*[^%q=]*)', sep, sep)) do

In this line string.format formats separator (which is & by default) using %q. %q specifier formats string such as it can be read by Lua interpreter. The final pattern will be ([^"&"=]+)(=*[^"&"=]*). gmatch is not a Lua interpreter and double quote in [] pattern will match any character but & or " (See the description). This is crucial because now " is also a valid separator.

local v = url.parse("http://example.com/?a=b\"c=d")

This code parses URL as this:

{
        host    =       example.com,
        authority       =       example.com,
        scheme  =       http,
        path    =       /,
        query   =       {
                        a       =       b,
                        c       =       d,
                }

}

But it's definitely wrong.