Parser: Two bugfixes, see below.

1. Use regexes to make sure strings are replaced globally
2. Use \0x1f (invisible unit separator char) as placeholder
   instead of \0xff which is ÿ (and might reasonably appear in the argstring).

Author: jcbrand

src/core/parser.js

@@ -229,8 +229,10 @@ define([
 
         _parseExtendedNotation: function argParserParseExtendedNotation(argstring) {
             var opts = {};
-            var parts = argstring.replace(";;", "\xff").replace("&", "&amp\xff").split(/;/)
-                        .map(function(el) { return el.replace("\xff", ";"); });
+            var parts = argstring.replace(/;;/g, "\0x1f").replace(/&/g, "&amp\0x1f").split(/;/)
+                        .map(function(el) {
+                            return el.replace(new RegExp("\0x1f", 'g'), ";");
+                        });
             _.each(parts, function (part, i) {
                 if (!part) { return; }
                 var matches = part.match(this.named_param_pattern);

src/pat/inject/inject.js

@@ -414,7 +414,7 @@ define([
             if (cfgs[0].nextHref && $el.is("a")) {
                 // In case next-href is specified the anchor's href will
                 // be set to it after the injection is triggered.
-                $el.attr({href: cfgs[0].nextHref});
+                $el.attr({href: cfgs[0].nextHref.replace(/&/g, '&')});
                 inject.destroy($el);
             }
             $el.off("pat-ajax-success.pat-inject");