Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gin 1.7.4 has redirect issue #3552

Closed
archfish opened this issue Mar 28, 2023 · 2 comments
Closed

gin 1.7.4 has redirect issue #3552

archfish opened this issue Mar 28, 2023 · 2 comments

Comments

@archfish
Copy link

Description

When request to //interact.sh router, there is no request log and get 301 response. Expected return http status 404.

NOTE. ONLY //interact.sh router can reproduce!

after upgrade gin to golan v1.20 and gin v1.9.0 it disappear.

How to reproduce

package main

import (
	"github.com/gin-gonic/gin"
)

func main() {
	Routes().Run(":3050")
}

func Routes() *gin.Engine {
	r := gin.Default()

	v1 := r.Group("/v1")

	addRoutes(v1)

	return r
}

func addRoutes(r *gin.RouterGroup) {
	r.Group("/api").
		POST("/deploy", deployApp).
		GET("/query", queryToken)
}

Expectations

# curl -vvv 'http://0.0.0.0:3050//interact.sh'

*   Trying 0.0.0.0:3050...
* Connected to 0.0.0.0 (127.0.0.1) port 3050 (#0)
> GET //interact.sh HTTP/1.1
> Host: 0.0.0.0:3050
> User-Agent: curl/7.86.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< Content-Type: text/plain
< Date: Tue, 28 Mar 2023 08:29:29 GMT
< Content-Length: 18
<
* Connection #0 to host 0.0.0.0 left intact
404 page not found%

Actual result

# curl -vvv 'http://0.0.0.0:3050//interact.sh'

*   Trying 0.0.0.0:3050...
* Connected to 0.0.0.0 (127.0.0.1) port 3050 (#0)
> GET //interact.sh HTTP/1.1
> Host: 0.0.0.0:3050
> User-Agent: curl/7.86.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< Content-Type: text/html; charset=utf-8
< Location: //interact.sh/
< Date: Tue, 28 Mar 2023 08:30:10 GMT
< Content-Length: 49
<
<a href="//interact.sh/">Moved Permanently</a>.

* Connection #0 to host 0.0.0.0 left intact

Environment

  • go version: 1.17
  • gin version (or commit ref): 1.7.4
  • operating system: macos linux(debian)
@archfish
Copy link
Author

archfish commented Mar 28, 2023

CVE-2018-11784

@archfish
Copy link
Author

fixed by #3500

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant