better quote special pattern characters

lib/resty/openidc.lua

@@ -291,14 +291,14 @@ local function openidc_base64_url_decode(input)
     local padlen = 4 - reminder
     input = input .. string.rep('=', padlen)
   end
-  input = input:gsub('-', '+'):gsub('_', '/')
+  input = input:gsub('%-', '+'):gsub('_', '/')
   return unb64(input)
 end
 
 -- perform base64url encoding
 local function openidc_base64_url_encode(input)
   local output = b64(input, true)
-  return output:gsub('+', '-'):gsub('/', '_')
+  return output:gsub('%+', '-'):gsub('/', '_')
 end
 
 local function openidc_combine_uri(uri, params)

tests/spec/pkce_spec.lua

@@ -53,7 +53,7 @@ describe('when pkce is disabled and the token endpoint is invoked', function()
   end)
 end)
 
-describe('when pkce is disabled and the token endpoint is invoked', function()
+describe('when pkce is enabled and the token endpoint is invoked', function()
   test_support.start_server({oidc_opts = { use_pkce = true } })
   teardown(test_support.stop_server)
 
@@ -81,7 +81,7 @@ describe('when pkce is disabled and the token endpoint is invoked', function()
       if rem > 0 then
         s = s .. string.rep('=', 4 - rem)
       end
-      return s:gsub('-', '+'):gsub('_', '/')
+      return s:gsub('%-', '+'):gsub('_', '/')
     end
     local challenge = as_base64(code_challenge)
     local hashed_verifier = (require 'mime').b64((require 'sha2').bytes(code_verifier))