From 84961d5133ee3217ad5cbfcfb9eda9fb586ccce2 Mon Sep 17 00:00:00 2001 From: nnposter Date: Mon, 16 Mar 2026 02:28:27 +0000 Subject: [PATCH] Interpret plus signs as spaces in url.parse_query --- CHANGELOG | 3 +++ nselib/url.lua | 1 + 2 files changed, 4 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index 291fba6a4..7f5b9a4db 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -12,6 +12,9 @@ o [NSE][GH#2183][GH#3239] Script hostmap-crtsh now reports only true subdomains necessarily as a suffix). The old behavior can be enabled by setting script argument hostmap-crtsh.lax. [Sweekar-cmd, nnposter] +o [NSE] Function url.parse_query was not interpreting plus signs as spaces. + [nnposter] + o [NSE] Function url.parse was not properly parsing URLs with query strings but empty paths. [nnposter] diff --git a/nselib/url.lua b/nselib/url.lua index 97ab0128a..121e5fb49 100644 --- a/nselib/url.lua +++ b/nselib/url.lua @@ -392,6 +392,7 @@ function parse_query(query) local pos = 1 query = string.gsub(query, "&([ampltg]+);", entities) + query = string.gsub(query, "%+", " ") local function ginsert(qstr) local pos = qstr:find("=", 1, true)