request.post double-encodes application/x-www-form-urlencoded data

Have you checked our README?

• I have checked the README

Have you followed our Troubleshooting?

• I have followed your Troubleshooting

Is there already an issue for your problem?

• I have checked older issues, open and closed

Have you checked the discussions?

• I have read the Discussions

Have you ACTUALLY checked all these?

YES

Environment

- FlareSolverr version: master at 0f05ed8fc974b215c36892b5a30122e27fe3c671
- Last working FlareSolverr version: unknown
- Operating system: Windows 11 (unit-level reproducer)
- Are you using Docker: no
- FlareSolverr User-Agent (see log traces or / endpoint): not applicable
- Are you using a VPN: no
- Are you using a Proxy: no
- URL to test this issue: any endpoint expecting application/x-www-form-urlencoded

Description

Description

request.post documents postData as application/x-www-form-urlencoded, but _post_request decodes each field and then percent-encodes it before placing it in a temporary HTML form. The browser form encoder encodes the percent signs again.

For example, a request with:

postData: "space=hello+world&encoded=one%26two&empty="

should submit the values hello world, one&two, and an empty value. Instead, the generated form contains encoded literals such as hello%2Bworld and one%26two, which are encoded again during submission.

request.post also does not validate that url is present before entering the browser-request flow, unlike request.get.

Expected behaviour

Parse postData once using standard form semantics (including + as a space), HTML-escape only while constructing the temporary form, and reject a missing url before starting a browser.

Proposed fix

Use urllib.parse.parse_qsl(..., keep_blank_values=True), percent-encode the full data URI instead of individual field values, and add the missing url validation. A focused regression test covers plus signs, percent-encoded ampersands, blank values, and missing-URL validation.

Logged Error Messages

No server error is required; the payload corruption is deterministic and is covered by a focused unit-level reproducer.

Screenshots

No response