This was caused by the sanitizer, which assumes input is HTML and escapes any entities it finds. This behavior cannot be avoided, so the output from the sanitizer is passed to CGI.unescapeHTML() so that any & in the URL is preserved in the final output.
↧
