From 2c2e15f5fedb2ec168513fe9668a7cd215adc34f Mon Sep 17 00:00:00 2001 From: t0rchwo0d Date: Fri, 17 Feb 2023 12:46:00 +0900 Subject: [PATCH] Fix #3500 Add escape logic for header --- gin.go | 15 ++++++++++++--- routes_test.go | 18 +++++++++++++----- 2 files changed, 25 insertions(+), 8 deletions(-) diff --git a/gin.go b/gin.go index 32dae2497f..7a3e1d4f3f 100644 --- a/gin.go +++ b/gin.go @@ -9,9 +9,9 @@ import ( "html/template" "net" "net/http" - "net/url" "os" "path" + "regexp" "strings" "sync" @@ -669,8 +669,9 @@ func redirectTrailingSlash(c *Context) { req := c.Request p := req.URL.Path if prefix := path.Clean(c.Request.Header.Get("X-Forwarded-Prefix")); prefix != "." { - prefix = url.QueryEscape(prefix) - prefix = strings.ReplaceAll(prefix, "%2F", "/") + reg := regexp.MustCompile("[^a-zA-Z0-9/-]+") + prefix = reg.ReplaceAllString(prefix, "") + prefix := removeRepeatedChar(prefix, '/') p = prefix + "/" + req.URL.Path } @@ -706,3 +707,11 @@ func redirectRequest(c *Context) { http.Redirect(c.Writer, req, rURL, code) c.writermem.WriteHeaderNow() } + +func removeRepeatedChar(s string, c rune) string { + re := regexp.MustCompile(fmt.Sprintf("%c{2,}", c)) + result := re.ReplaceAllStringFunc(s, func(match string) string { + return string(c) + }) + return result +} diff --git a/routes_test.go b/routes_test.go index 5310caec25..6e9e480317 100644 --- a/routes_test.go +++ b/routes_test.go @@ -185,16 +185,24 @@ func TestRouteRedirectTrailingSlash(t *testing.T) { w = PerformRequest(router, http.MethodGet, "/path2/", header{Key: "X-Forwarded-Prefix", Value: "/api/"}) assert.Equal(t, 200, w.Code) - w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../bug#?"}) - assert.Equal(t, "../../../bug%2523%253F/path", w.Header().Get("Location")) + w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../api#?"}) + assert.Equal(t, "/api/path", w.Header().Get("Location")) + assert.Equal(t, 301, w.Code) + + w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../../../api"}) + assert.Equal(t, "/api/path", w.Header().Get("Location")) assert.Equal(t, 301, w.Code) w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "https://gin-gonic.com/#"}) - assert.Equal(t, "https%3A/gin-gonic.com/%23/https%253A/gin-gonic.com/%2523/path", w.Header().Get("Location")) + assert.Equal(t, "https/gin-goniccom/https/gin-goniccom/path", w.Header().Get("Location")) + assert.Equal(t, 301, w.Code) + + w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#api"}) + assert.Equal(t, "api/api/path", w.Header().Get("Location")) assert.Equal(t, 301, w.Code) - w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#bug"}) - assert.Equal(t, "%23bug/%2523bug/path", w.Header().Get("Location")) + w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "/nor-mal/#?a=1"}) + assert.Equal(t, "/nor-mal/a1/path", w.Header().Get("Location")) assert.Equal(t, 301, w.Code) router.RedirectTrailingSlash = false