serv/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2025-01-13 22:36:27 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

rewrite: use escaped path, fix #5278 (#5504)

Browse source 
* use escaped path while rewriting

Signed-off-by: TP-O <letranphong2k1@gmail.com>

* restore line break

---------

Signed-off-by: TP-O <letranphong2k1@gmail.com>
This commit is contained in:
Tran Phong 2023-05-16 22:16:07 +07:00 committed by GitHub
parent e8352aef38
commit 13a37688dc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
modules/caddyhttp/rewrite/rewrite.go
View file

@ -195,16 +195,10 @@ func (rewr Rewrite) Rewrite(r *http.Request, repl *caddy.Replacer) bool {
var newPath, newQuery, newFrag string
if path != "" {
// Since the 'uri' placeholder performs a URL-encode,
// we need to intercept it so that it doesn't, because
// otherwise we risk a double-encode of the path.
uriPlaceholder := "{http.request.uri}"
if strings.Contains(path, uriPlaceholder) {
tmpUri := r.URL.Path
if r.URL.RawQuery != "" {
tmpUri += "?" + r.URL.RawQuery
}
path = strings.ReplaceAll(path, uriPlaceholder, tmpUri)
// replace the `path` placeholder to escaped path
pathPlaceholder := "{http.request.uri.path}"
if strings.Contains(path, pathPlaceholder) {
path = strings.ReplaceAll(path, pathPlaceholder, r.URL.EscapedPath())
}
newPath = repl.ReplaceAll(path, "")
@ -232,7 +226,11 @@ func (rewr Rewrite) Rewrite(r *http.Request, repl *caddy.Replacer) bool {
// update the URI with the new components
// only after building them
if pathStart >= 0 {
r.URL.Path = newPath
if path, err := url.PathUnescape(newPath); err != nil {
r.URL.Path = newPath
} else {
r.URL.Path = path
}
}
if qsStart >= 0 {
r.URL.RawQuery = newQuery

12
modules/caddyhttp/rewrite/rewrite_test.go
View file

@ -59,6 +59,16 @@ func TestRewrite(t *testing.T) {
input: newRequest(t, "GET", "/"),
expect: newRequest(t, "GET", "foo"),
},
{
rule: Rewrite{URI: "{http.request.uri}"},
input: newRequest(t, "GET", "/bar%3Fbaz?c=d"),
expect: newRequest(t, "GET", "/bar%3Fbaz?c=d"),
},
{
rule: Rewrite{URI: "{http.request.uri.path}"},
input: newRequest(t, "GET", "/bar%3Fbaz"),
expect: newRequest(t, "GET", "/bar%3Fbaz"),
},
{
rule: Rewrite{URI: "/foo{http.request.uri.path}"},
input: newRequest(t, "GET", "/bar"),
@ -323,7 +333,7 @@ func TestRewrite(t *testing.T) {
input: newRequest(t, "GET", "/foo/findme%2Fbar"),
expect: newRequest(t, "GET", "/foo/replaced%2Fbar"),
},
{
rule: Rewrite{PathRegexp: []*regexReplacer{{Find: "/{2,}", Replace: "/"}}},
input: newRequest(t, "GET", "/foo//bar///baz?a=b//c"),