url_encode does not encode properly for query parameters or form fields

[xstevens]

Describe the bug
The DSL functions url_encode and url_decode are backed by Go's url.PathEscape. As a result special characters such as & that might be included in attack payloads (e.g. command injection) won't be properly encoded for query parameters or form fields.

Nuclei version
2.4.3

Screenshot of the error or bug
Using a payload such as && cat /etc/passwd inside a command injection template, you might use something like this:

requests:
  - payloads:
      cmdexe: payloads/cmdexe/one.txt
      
    attack: sniper

    raw:
      - |
        GET /get?p={{url_encode(cmdexe)}} HTTP/1.1
        Host: {{Hostname}}
        Connection: close

      - |
        POST /post HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Connection: close

        p={{url_encode(cmdexe)}}

With debug request option on it sends the request:

GET /get?p=&&%20cat%20%2Fetc%2Fpasswd HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Accept: */*
Connection: close
Accept-Encoding: gzip

...

POST /post HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Length: 27
Accept: */*
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

p=&&%20cat%20%2Fetc%2Fpasswd

The payload is not correctly encoded.

[Ice3man543]

@xstevens thank you for reporting this. This has been fixed in the dev branch by #980. This will be available in the next release.