{"action":"opened","issue":{"url":"https://api.github.com/repos/Arachni/arachni/issues/712","repository_url":"https://api.github.com/repos/Arachni/arachni","labels_url":"https://api.github.com/repos/Arachni/arachni/issues/712/labels{/name}","comments_url":"https://api.github.com/repos/Arachni/arachni/issues/712/comments","events_url":"https://api.github.com/repos/Arachni/arachni/issues/712/events","html_url":"https://github.com/Arachni/arachni/issues/712","id":153755595,"number":712,"title":"Plus-signs in query from Location header are incorrectly URL-encoded when following a redirect.","user":{"login":"ordinaehs","id":17293583,"avatar_url":"https://avatars.githubusercontent.com/u/17293583?v=3","gravatar_id":"","url":"https://api.github.com/users/ordinaehs","html_url":"https://github.com/ordinaehs","followers_url":"https://api.github.com/users/ordinaehs/followers","following_url":"https://api.github.com/users/ordinaehs/following{/other_user}","gists_url":"https://api.github.com/users/ordinaehs/gists{/gist_id}","starred_url":"https://api.github.com/users/ordinaehs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ordinaehs/subscriptions","organizations_url":"https://api.github.com/users/ordinaehs/orgs","repos_url":"https://api.github.com/users/ordinaehs/repos","events_url":"https://api.github.com/users/ordinaehs/events{/privacy}","received_events_url":"https://api.github.com/users/ordinaehs/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-09T11:24:25Z","updated_at":"2016-05-09T11:24:25Z","closed_at":null,"body":"I was having trouble getting the login_script plugin to log me into a private site. The login form uses multiple 302 redirects, and the very last one of these fails. The 302 sends a Location-header back with a query-part, containing plus signs (indicating spaces). However, the URL that Arachni then visits next has %2B's (plus sign URL encoded) instead. The server obviously fails the request, and the login fails.\r\n\r\nI found a (very bad, don't use in production!) workaround:\r\n\r\nAdd lib/arachni/http/client.rb, line 520:\r\n`request.url = request.url.gsub('+', ' ')`\r\n\r\nThis corrects the issue; the redirect then gets followed correctly, and the login_script plugin succeeds. So somewhere along the way, the Location-header gets URL-encoded without being decoded first, causing the plus-signs in the query-part of the URI to be corrupted."}}