In T304237#7790867 it was discovered that most http-related checks in our Icinga configuration don't quote the URL argument, and as such might lead to unwanted results.
In particular if an URL contains an ampersend (&), the rest of the URL/check parameters are truncated and the check is executed in background, always returning 0 (OK) to Icinga even in case of failure.
This gives the false security of checking something that will not be actually checked.
This is the full list of check commands in modules/nagios_common/templates/checkcommands.cfg.erb that use the URL parameter without quotes:
check_https_port_status check_http_unauthorized check_https_unauthorized check_https_client_auth_puppet check_https_client_auth_puppet_post check_http_redirect check_https_redirect check_https_sso_redirect check_http_url_at_address_for_string_with_timeout check_http_url_at_address_for_string check_https_url_at_address_for_string check_https_url_at_address_for_minsize check_http_url_for_string check_https_url_for_string check_http_url_for_regexp_on_port check_http_url check_https_url check_https_url_custom_ip
I didn't grep all of them into the puppet repo or the Icinga configuration to extract the current amount of affected checks.
Keep into account that this is also related to T304321, and many of the above checks are both using and URL and the -Cparameter, so the URL is actually ignored.
I think this one too should be fixed ASAP.