From da5a95bb2aa104a6ed6f9ff312364d905ef4d172 Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <felipe.zipitria@owasp.org>
Date: Sat, 5 Mar 2022 19:30:59 -0300
Subject: [PATCH] fix(request): fix data request parsing

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
---
 ftwhttp/client_test.go  |  2 +-
 ftwhttp/request.go      |  4 ++--
 ftwhttp/request_test.go | 26 +++++++++++++++++++++++++-
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/ftwhttp/client_test.go b/ftwhttp/client_test.go
index f285f732..6ac679cc 100644
--- a/ftwhttp/client_test.go
+++ b/ftwhttp/client_test.go
@@ -72,7 +72,7 @@ func TestGetTrackedTime(t *testing.T) {
 
 	h := Header{"Accept": "*/*", "User-Agent": "go-ftw test agent", "Host": "localhost"}
 
-	data := []byte(`test=me&one=two`)
+	data := []byte(`test=me&one=two&one=twice`)
 	req := NewRequest(rl, h, data, true)
 
 	err := c.NewConnection(*d)
diff --git a/ftwhttp/request.go b/ftwhttp/request.go
index c1f2f04e..5e935253 100644
--- a/ftwhttp/request.go
+++ b/ftwhttp/request.go
@@ -202,8 +202,8 @@ func encodeDataParameters(h Header, data []byte) ([]byte, error) {
 	if h.Get(ContentTypeHeader) == "application/x-www-form-urlencoded" {
 		if escapedData, _ := url.QueryUnescape(string(data)); escapedData == string(data) {
 			queryString, err := url.ParseQuery(string(data))
-			if err != nil || emptyQueryValues(queryString) {
-				return data, err
+			if (err != nil && strings.Contains(err.Error(), "invalid semicolon separator in query")) || emptyQueryValues(queryString) {
+				return data, nil
 			}
 			encodedData := queryString.Encode()
 			if encodedData != string(data) {
diff --git a/ftwhttp/request_test.go b/ftwhttp/request_test.go
index 2c95f307..afd4a579 100644
--- a/ftwhttp/request_test.go
+++ b/ftwhttp/request_test.go
@@ -231,7 +231,7 @@ func TestRequestRawData(t *testing.T) {
 	}
 }
 
-func TestRequesSettingDataaWhenThereIsRawData(t *testing.T) {
+func TestRequestSettingDataaWhenThereIsRawData(t *testing.T) {
 	req := generateBaseRawRequestForTesting()
 
 	err := req.SetData([]byte("This is the data now"))
@@ -242,3 +242,27 @@ func TestRequesSettingDataaWhenThereIsRawData(t *testing.T) {
 		t.Errorf("Failed !")
 	}
 }
+
+func TestRequestURLParse(t *testing.T) {
+	req := generateBaseRequestForTesting()
+
+	h := req.Headers()
+	h.Add(ContentTypeHeader, "application/x-www-form-urlencoded")
+	// Test adding semicolons to test parse
+	err := req.SetData([]byte("test=This&test=nothing"))
+	if err != nil {
+		t.Errorf("Failed !")
+	}
+}
+
+func TestRequestURLParseFail(t *testing.T) {
+	req := generateBaseRequestForTesting()
+
+	h := req.Headers()
+	h.Add(ContentTypeHeader, "application/x-www-form-urlencoded")
+	// Test adding semicolons to test parse
+	err := req.SetData([]byte("test=This&that=but with;;;;;; data now"))
+	if err != nil {
+		t.Errorf("Failed !")
+	}
+}