Skip to content

Commit

Permalink
Fix gin-gonic#3500 Add escape logic for header
Browse files Browse the repository at this point in the history
  • Loading branch information
t0rchwo0d committed Feb 17, 2023
1 parent 81ac7d5 commit fd9f98e
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 6 deletions.
6 changes: 3 additions & 3 deletions gin.go
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ import (
"html/template"
"net"
"net/http"
"net/url"
"os"
"path"
"regexp"
"strings"
"sync"

Expand Down Expand Up @@ -669,8 +669,8 @@ func redirectTrailingSlash(c *Context) {
req := c.Request
p := req.URL.Path
if prefix := path.Clean(c.Request.Header.Get("X-Forwarded-Prefix")); prefix != "." {
prefix = url.QueryEscape(prefix)
prefix = strings.ReplaceAll(prefix, "%2F", "/")
reg := regexp.MustCompile("[^a-zA-Z0-9/-]+")
prefix = reg.ReplaceAllString(prefix, "")

p = prefix + "/" + req.URL.Path
}
Expand Down
10 changes: 7 additions & 3 deletions routes_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -186,15 +186,19 @@ func TestRouteRedirectTrailingSlash(t *testing.T) {
assert.Equal(t, 200, w.Code)

w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../bug#?"})
assert.Equal(t, "../../../bug%2523%253F/path", w.Header().Get("Location"))
assert.Equal(t, "//bug//path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)

w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "https://gin-gonic.com/#"})
assert.Equal(t, "https%3A/gin-gonic.com/%23/https%253A/gin-gonic.com/%2523/path", w.Header().Get("Location"))
assert.Equal(t, "https/gin-goniccom/https/gin-goniccom/path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)

w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#bug"})
assert.Equal(t, "%23bug/%2523bug/path", w.Header().Get("Location"))
assert.Equal(t, "bug/bug/path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)

w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "/nor-mal/#?a=1"})
assert.Equal(t, "/nor-mal/a1/path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)

router.RedirectTrailingSlash = false
Expand Down

0 comments on commit fd9f98e

Please sign in to comment.