diff -up kleopatra-19.12.2/src/kleopatraapplication.cpp.me kleopatra-19.12.2/src/kleopatraapplication.cpp
--- kleopatra-19.12.2/src/kleopatraapplication.cpp.me	2020-10-12 11:33:05.987075995 +0200
+++ kleopatra-19.12.2/src/kleopatraapplication.cpp	2020-10-12 11:37:47.047704984 +0200
@@ -267,13 +267,18 @@ QString KleopatraApplication::newInstanc
 
     QStringList files;
     const QDir cwd = QDir(workingDirectory);
-    Q_FOREACH (const QString &file, parser.positionalArguments()) {
-        // We do not check that file exists here. Better handle
-        // these errors in the UI.
-        if (QFileInfo(file).isAbsolute()) {
-            files << file;
-        } else {
-            files << cwd.absoluteFilePath(file);
+    bool queryMode = parser.isSet(QStringLiteral("query")) || parser.isSet(QStringLiteral("search"));
+
+    // Query and Search treat positional arguments differently, see below.
+    if (!queryMode) {
+        Q_FOREACH (const QString &file, parser.positionalArguments()) {
+            // We do not check that file exists here. Better handle
+            // these errors in the UI.
+            if (QFileInfo(file).isAbsolute()) {
+                files << file;
+            } else {
+                files << cwd.absoluteFilePath(file);
+            }
         }
     }
 
@@ -307,10 +312,8 @@ QString KleopatraApplication::newInstanc
 
     // Handle openpgp4fpr URI scheme
     QString needle;
-    if (parser.isSet(QStringLiteral("search"))) {
-        needle = parser.value(QStringLiteral("search"));
-    } else if (parser.isSet(QStringLiteral("query"))) {
-        needle = parser.value(QStringLiteral("query"));
+    if (queryMode) {
+        needle = parser.positionalArguments().join(QLatin1Char(' '));
     }
     if (needle.startsWith(QLatin1String("openpgp4fpr:"))) {
         needle.remove(0, 12);
diff -up kleopatra-19.12.2/src/kleopatra_options.h.me kleopatra-19.12.2/src/kleopatra_options.h
--- kleopatra-19.12.2/src/kleopatra_options.h.me	2020-10-12 11:28:44.805768637 +0200
+++ kleopatra-19.12.2/src/kleopatra_options.h	2020-10-12 11:40:35.288476417 +0200
@@ -79,8 +79,7 @@ static void kleopatra_options(QCommandLi
                                   << QStringLiteral("D"),
                                   i18n("Decrypt and/or verify file(s)"))
             << QCommandLineOption(QStringList() << QStringLiteral("search"),
-                                  i18n("Search for a certificate on a keyserver"),
-                                  QStringLiteral("search string"))
+                                  i18n("Search for a certificate on a keyserver"))
             << QCommandLineOption(QStringList() << QStringLiteral("checksum"),
                                   i18n("Create or check a checksum file"))
             << QCommandLineOption(QStringList() << QStringLiteral("query")
@@ -88,8 +87,7 @@ static void kleopatra_options(QCommandLi
                                   i18nc("If a certificate is already known it shows the certificate details dialog."
                                         "Otherwise it brings up the certificate search dialog.",
                                         "Show details of a local certificate or search for it on a keyserver"
-                                        " by fingerprint"),
-                                  QStringLiteral("fingerprint"))
+                                        " by fingerprint"))
             << QCommandLineOption(QStringList() << QStringLiteral("gen-key"),
                                   i18n("Create a new key pair or certificate signing request"))
             << QCommandLineOption(QStringLiteral("parent-windowid"),
@@ -99,11 +97,22 @@ static void kleopatra_options(QCommandLi
                                   i18n("Open the config dialog"));
 
     parser->addOptions(options);
+    /* Security note: To avoid code execution by shared library injection
+     * through e.g. -platformpluginpath any external input should be seperated
+     * by a double dash -- this is why query / search uses positional arguments.
+     *
+     * For example on Windows there is an URLhandler for openpgp4fpr:
+     * be opened with Kleopatra's query function. And while a browser should
+     * urlescape such a query there might be tricks to inject a quote character
+     * and as such inject command line options for Kleopatra in an URL. */
     parser->addVersionOption();
     parser->addHelpOption();
 
     parser->addPositionalArgument(QStringLiteral("files"),
                                   i18n("File(s) to process"),
-                                  QStringLiteral("[files..]"));
+                                  QStringLiteral("-- [files..]"));
+     parser->addPositionalArgument(QStringLiteral("query"),
+                                  i18n("String or Fingerprint for query and search"),
+                                  QStringLiteral("-- [query..]"));
 }
 #endif