www: avoid misinterpreting '&' and ';' in query parameters

Oops, we must unescape each key=value pair in a QUERY_STRING
individually; otherwise we cannot interpret '&' or ';' in
query parameter values.

diff --git a/lib/PublicInbox/WWW.pm b/lib/PublicInbox/WWW.pm
index 26cd571cf571d52d9a3e97f0bf5a300cc3d715e0..60cb4430114e3e9bd87baa71a956dd0c957affc7 100644 (file)
--- a/lib/PublicInbox/WWW.pm
+++ b/lib/PublicInbox/WWW.pm
@@ -41,11 +41,11 @@ sub call {
 
        # we don't care about multi-value
        my %qp = map {
-               my ($k, $v) = split('=', $_, 2);
+               my ($k, $v) = split('=', uri_unescape($_), 2);
                $v = '' unless defined $v;
                $v =~ tr/+/ /;
                ($k, $v)
-       } split(/[&;]/, uri_unescape($env->{QUERY_STRING}));
+       } split(/[&;]/, $env->{QUERY_STRING});
        $ctx->{qp} = \%qp;
 
        my $path_info = $env->{PATH_INFO};