-
Notifications
You must be signed in to change notification settings - Fork 18k
net/http/httputil: handle escaped paths in SingleHostReverseProxy #36378
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
When forwarding a request, a SingleHostReverseProxy appends the request's path to the target URL's path. However, if certain path elements are encoded, (such as %2F for slash in either the request or target path), simply joining the URL.Path elements is not sufficient, since the field holds the *decoded* path. Since 87a605, the RawPath field was added which holds a decoding hint for the URL. When joining URL paths, this decoding hint needs to be taken into consideration. As an example, if the target URL.Path is /a/b, and URL.RawPath is /a%2Fb, joining the path with /c should result in /a/b/c URL.Path, and /a%2Fb/c in RawPath. The added joinURLPath function combines the two URL's Paths, while taking into account escaping, and replaces the previously used singleJoiningSlash in NewSingleHostReverseProxy. Fixes #35908
Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). 📝 Please visit https://cla.developers.google.com/ to sign. Once you've signed (or fixed any issues), please reply here with What to do if you already signed the CLAIndividual signers
Corporate signers
ℹ️ Googlers: Go here for more info. |
@googlebot I signed it! |
CLAs look good, thanks! ℹ️ Googlers: Go here for more info. |
This PR (HEAD: f67619d) has been imported to Gerrit for code review. Please visit https://go-review.googlesource.com/c/go/+/213257 to see it. Tip: You can toggle comments from me using the |
Message from Gobot Gobot: Patch Set 1: Congratulations on opening your first change. Thank you for your contribution! Next steps: Most changes in the Go project go through a few rounds of revision. This can be During May-July and Nov-Jan the Go project is in a code freeze, during which Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
Message from Brad Fitzpatrick: Patch Set 1: Code-Review+1 (2 comments) Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
The comment on using %q instead of %s in formatting strings in errors is also applicable to the output of TestSingleJoinSlash, so I took the liberty of fixing that also.
This PR (HEAD: 7be6b8d) has been imported to Gerrit for code review. Please visit https://go-review.googlesource.com/c/go/+/213257 to see it. Tip: You can toggle comments from me using the |
Hi, just wanted to check on this PR, and make sure it isn't lost in the current chaos. I have implemented the requested modifications - please let me know if there is anything more I can do to help in fixing the issue! |
Message from Daniel Kumor: Patch Set 2: (2 comments) Hi, just wanted to check on this PR, and make sure it isn't lost in the current chaos. I have implemented the requested modifications in patch set 2 - please let me know if there is anything more I can do to help in fixing the issue! Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
Message from Ian Lance Taylor: Patch Set 2: Run-TryBot+1 Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
Message from Gobot Gobot: Patch Set 2: TryBots beginning. Status page: https://farmer.golang.org/try?commit=686781f0 Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
Message from Gobot Gobot: Patch Set 2: TryBot-Result+1 TryBots are happy. Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
Message from Brad Fitzpatrick: Patch Set 2: Code-Review+2 Please don’t reply on this GitHub thread. Visit golang.org/cl/213257. |
When forwarding a request, a SingleHostReverseProxy appends the request's path to the target URL's path. However, if certain path elements are encoded, (such as %2F for slash in either the request or target path), simply joining the URL.Path elements is not sufficient, since the field holds the decoded path. Since 87a605, the RawPath field was added which holds a decoding hint for the URL. When joining URL paths, this decoding hint needs to be taken into consideration. As an example, if the target URL.Path is /a/b, and URL.RawPath is /a%2Fb, joining the path with /c should result in /a/b/c in URL.Path, and /a%2Fb/c in RawPath. The added joinURLPath function combines the two URL's Paths, while taking into account escaping, and replaces the previously used singleJoiningSlash in NewSingleHostReverseProxy. Fixes #35908 Change-Id: I45886aee548431fe4031883ab1629a41e35f1727 GitHub-Last-Rev: 7be6b8d GitHub-Pull-Request: #36378 Reviewed-on: https://go-review.googlesource.com/c/go/+/213257 Run-TryBot: Ian Lance Taylor <[email protected]> TryBot-Result: Gobot Gobot <[email protected]> Reviewed-by: Brad Fitzpatrick <[email protected]>
This PR is being closed because golang.org/cl/213257 has been merged. |
When forwarding a request, a SingleHostReverseProxy appends the request's path to the target URL's path. However, if certain path elements are encoded, (such as %2F for slash in either the request or target path), simply joining the URL.Path elements is not sufficient, since the field holds the decoded path. Since 87a605, the RawPath field was added which holds a decoding hint for the URL. When joining URL paths, this decoding hint needs to be taken into consideration. As an example, if the target URL.Path is /a/b, and URL.RawPath is /a%2Fb, joining the path with /c should result in /a/b/c in URL.Path, and /a%2Fb/c in RawPath. The added joinURLPath function combines the two URL's Paths, while taking into account escaping, and replaces the previously used singleJoiningSlash in NewSingleHostReverseProxy. Fixes golang#35908 Change-Id: I45886aee548431fe4031883ab1629a41e35f1727 GitHub-Last-Rev: 7be6b8d GitHub-Pull-Request: golang#36378 Reviewed-on: https://go-review.googlesource.com/c/go/+/213257 Run-TryBot: Ian Lance Taylor <[email protected]> TryBot-Result: Gobot Gobot <[email protected]> Reviewed-by: Brad Fitzpatrick <[email protected]>
When forwarding a request, a SingleHostReverseProxy appends the
request's path to the target URL's path. However, if certain path
elements are encoded, (such as %2F for slash in either the request or
target path), simply joining the URL.Path elements is not sufficient,
since the field holds the decoded path.
Since 87a605, the RawPath field was added which holds a decoding
hint for the URL. When joining URL paths, this decoding hint needs
to be taken into consideration.
As an example, if the target URL.Path is /a/b, and URL.RawPath
is /a%2Fb, joining the path with /c should result in /a/b/c
in URL.Path, and /a%2Fb/c in RawPath.
The added joinURLPath function combines the two URL's Paths,
while taking into account escaping, and replaces the previously used
singleJoiningSlash in NewSingleHostReverseProxy.
Fixes #35908