BUG/MINOR: http: http-request replace-path duplicates the query string

In http_action_replace_uri() we call http_get_path() in the case of
a replace-path rule. http_get_path() will return an ist pointing to
the start of the path, but uri.ptr + uri.len points to the end of the
uri. As as result, we are matching against a string containing the
query, which we append to the "path" later, effectively duplicating
the query string.

This patch uses the iststop() function introduced in "MINOR: ist: add
an iststop() function" to find the '?' character and update the ist
length when needed.

This fixes issue #510.

The bug was introduced by commit 262c3f1a ("MINOR: http: add a new
"replace-path" action"), which was backported to 2.1 and 2.0.

(cherry picked from commit 4bbc9494b75b6f987c813546c1fa79a5e883a188)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
(cherry picked from commit 31e91e5929fbb3b12171ad91fca72d217ad6ad9b)
Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
diff --git a/src/http_act.c b/src/http_act.c
index 14845aa..1e235f8 100644
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -157,7 +157,7 @@
 		uri = ist2(ci_head(&s->req) + s->txn->req.sl.rq.u, s->txn->req.sl.rq.u_l);
 
 	if (rule->arg.act.p[0] == (void *)1)
-		uri = http_get_path(uri); // replace path
+		uri = iststop(http_get_path(uri), '?');
 
 	if (!regex_exec_match2(rule->arg.act.p[1], uri.ptr, uri.len, MAX_MATCH, pmatch, 0))
 		goto leave;