net/url: parseQuery() does not check for semicolon(`;`) in url

[zer0yu]

What version of Go are you using (go version)?

$ go version
go version go1.18.5 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/zero/Library/Caches/go-build"
GOENV="/Users/zero/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/zero/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/zero/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.18.5"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/zero/opt/uc/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/89/6db44hqj2zgc46hbjm6bc5x40000gn/T/go-build4274838272=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

What did you expect to see?

import (
	"net/url"
)

func main() {
line = "http://example.com/page.php?uid=2;123"
parsed, err := url.Parse(line)
fmt.Println(url.ParseQuery(parsed.RawQuery))
}

expect

map[uid:[2;123]]

but in fact

map[]

A nil value is returned when the query URL contains a semicolon(;) character

What did you see instead?

semicolon(;) character is parsed into the value of the dict

[narslan]

url.ParseQuery would throw the error invalid semicolon separator in query if it hadn't been suppressed.
You might find the relevant code change explanatory that introduces this behavior.
net/url: reject query values with semicolons

A workaround might be:
parsed.RawQuery = strings.ReplaceAll(parsed.RawQuery, ";", "%3b")

[seankhliao]

This is working as intended. net/url.Parse just stores net/url.URL.RawQuery which is only parsed on demand, either by net/url.URL.Query() (dropping malformed values) or net/url.ParseQuery() (reporting an error). Both are documented.