Fix gin-gonic#3500 Add escape logic for header

t0rchwo0d · Feb 17, 2023 · bd78de0 · bd78de0
1 parent 81ac7d5
commit bd78de0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/gin.go b/gin.go
@@ -670,6 +670,7 @@ func redirectTrailingSlash(c *Context) {
 	p := req.URL.Path
 	if prefix := path.Clean(c.Request.Header.Get("X-Forwarded-Prefix")); prefix != "." {
 		prefix = url.QueryEscape(prefix)
+		prefix = strings.ReplaceAll(prefix, ".", "")
 		prefix = strings.ReplaceAll(prefix, "%2F", "/")
 
 		p = prefix + "/" + req.URL.Path

diff --git a/routes_test.go b/routes_test.go
@@ -186,11 +186,11 @@ func TestRouteRedirectTrailingSlash(t *testing.T) {
 	assert.Equal(t, 200, w.Code)
 
 	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../bug#?"})
-	assert.Equal(t, "../../../bug%2523%253F/path", w.Header().Get("Location"))
+	assert.Equal(t, "//bug%2523%253F//path", w.Header().Get("Location"))
 	assert.Equal(t, 301, w.Code)
 
 	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "https://gin-gonic.com/#"})
-	assert.Equal(t, "https%3A/gin-gonic.com/%23/https%253A/gin-gonic.com/%2523/path", w.Header().Get("Location"))
+	assert.Equal(t, "https%3A/gin-goniccom/%23/https%253A/gin-goniccom/%2523/path", w.Header().Get("Location"))
 	assert.Equal(t, 301, w.Code)
 
 	w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#bug"})