CVE-2022-34296: Query predicate bypass in Zalando Skipper

The vulnerability stems from the lack of raw query validation before processing query parameters in routing predicates. The fix introduced the ValidateQueryHandler in net/query.go, which parses the raw query upfront using url.ParseQuery(). In vulnerable versions, this validation was missing, allowing attackers to craft queries (e.g., 'foo=bar;') that bypassed predicate checks like Query("foo"). The vulnerable code path was the default request handling flow, which did not include this validation step. The key issue was not a specific function but the absence of the validation middleware, which allowed malformed queries to reach predicate logic with improperly parsed parameters.