From 2c2e15f5fedb2ec168513fe9668a7cd215adc34f Mon Sep 17 00:00:00 2001
From: t0rchwo0d <huiseong.seo@linecorp.com>
Date: Fri, 17 Feb 2023 12:46:00 +0900
Subject: [PATCH] Fix #3500 Add escape logic for header

---
 gin.go         | 15 ++++++++++++---
 routes_test.go | 18 +++++++++++++-----
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/gin.go b/gin.go
index 32dae2497f..7a3e1d4f3f 100644
--- a/gin.go
+++ b/gin.go
@@ -9,9 +9,9 @@ import (
 	"html/template"
 	"net"
 	"net/http"
-	"net/url"
 	"os"
 	"path"
+	"regexp"
 	"strings"
 	"sync"
 
@@ -669,8 +669,9 @@ func redirectTrailingSlash(c *Context) {
 	req := c.Request
 	p := req.URL.Path
 	if prefix := path.Clean(c.Request.Header.Get("X-Forwarded-Prefix")); prefix != "." {
-		prefix = url.QueryEscape(prefix)
-		prefix = strings.ReplaceAll(prefix, "%2F", "/")
+		reg := regexp.MustCompile("[^a-zA-Z0-9/-]+")
+		prefix = reg.ReplaceAllString(prefix, "")
+		prefix := removeRepeatedChar(prefix, '/')
 
 		p = prefix + "/" + req.URL.Path
 	}
@@ -706,3 +707,11 @@ func redirectRequest(c *Context) {
 	http.Redirect(c.Writer, req, rURL, code)
 	c.writermem.WriteHeaderNow()
 }
+
+func removeRepeatedChar(s string, c rune) string {
+	re := regexp.MustCompile(fmt.Sprintf("%c{2,}", c))
+	result := re.ReplaceAllStringFunc(s, func(match string) string {
+		return string(c)
+	})
+	return result
+}
diff --git a/routes_test.go b/routes_test.go
index 5310caec25..6e9e480317 100644
--- a/routes_test.go
+++ b/routes_test.go
@@ -185,16 +185,24 @@ func TestRouteRedirectTrailingSlash(t *testing.T) {
 	w = PerformRequest(router, http.MethodGet, "/path2/", header{Key: "X-Forwarded-Prefix", Value: "/api/"})
 	assert.Equal(t, 200, w.Code)
 
-	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../bug#?"})
-	assert.Equal(t, "../../../bug%2523%253F/path", w.Header().Get("Location"))
+	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../api#?"})
+	assert.Equal(t, "/api/path", w.Header().Get("Location"))
+	assert.Equal(t, 301, w.Code)
+
+	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../../../api"})
+	assert.Equal(t, "/api/path", w.Header().Get("Location"))
 	assert.Equal(t, 301, w.Code)
 
 	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "https://gin-gonic.com/#"})
-	assert.Equal(t, "https%3A/gin-gonic.com/%23/https%253A/gin-gonic.com/%2523/path", w.Header().Get("Location"))
+	assert.Equal(t, "https/gin-goniccom/https/gin-goniccom/path", w.Header().Get("Location"))
+	assert.Equal(t, 301, w.Code)
+
+	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#api"})
+	assert.Equal(t, "api/api/path", w.Header().Get("Location"))
 	assert.Equal(t, 301, w.Code)
 
-	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#bug"})
-	assert.Equal(t, "%23bug/%2523bug/path", w.Header().Get("Location"))
+	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "/nor-mal/#?a=1"})
+	assert.Equal(t, "/nor-mal/a1/path", w.Header().Get("Location"))
 	assert.Equal(t, 301, w.Code)
 
 	router.RedirectTrailingSlash = false