mirror
/
gin
mirror of https://github.com/gin-gonic/gin.git
1
0
Fork 1
Code Issues Packages Projects Releases Wiki Activity

Add escape logic for header (#3500)

This commit is contained in:
t0rchwo0d 2023-02-17 11:00:19 +09:00 committed by GitHub
parent d07db174ac
commit 81ac7d55a0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gin.go
View File

@ -9,6 +9,7 @@ import (
"html/template" "html/template"
"net" "net"
"net/http" "net/http"
"net/url"
"os" "os"
"path" "path"
"strings" "strings"
@ -668,6 +669,9 @@ func redirectTrailingSlash(c *Context) {
req := c.Request req := c.Request
p := req.URL.Path p := req.URL.Path
if prefix := path.Clean(c.Request.Header.Get("X-Forwarded-Prefix")); prefix != "." { if prefix := path.Clean(c.Request.Header.Get("X-Forwarded-Prefix")); prefix != "." {
prefix = url.QueryEscape(prefix)
prefix = strings.ReplaceAll(prefix, "%2F", "/")
p = prefix + "/" + req.URL.Path p = prefix + "/" + req.URL.Path
} }
req.URL.Path = p + "/" req.URL.Path = p + "/"

12
routes_test.go
View File

@ -185,6 +185,18 @@ func TestRouteRedirectTrailingSlash(t *testing.T) {
w = PerformRequest(router, http.MethodGet, "/path2/", header{Key: "X-Forwarded-Prefix", Value: "/api/"}) w = PerformRequest(router, http.MethodGet, "/path2/", header{Key: "X-Forwarded-Prefix", Value: "/api/"})
assert.Equal(t, 200, w.Code) assert.Equal(t, 200, w.Code)
w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "../../bug#?"})
assert.Equal(t, "../../../bug%2523%253F/path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)
w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "https://gin-gonic.com/#"})
assert.Equal(t, "https%3A/gin-gonic.com/%23/https%253A/gin-gonic.com/%2523/path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)
w = PerformRequest(router, http.MethodGet, "/path/", header{Key: "X-Forwarded-Prefix", Value: "#bug"})
assert.Equal(t, "%23bug/%2523bug/path", w.Header().Get("Location"))
assert.Equal(t, 301, w.Code)
router.RedirectTrailingSlash = false router.RedirectTrailingSlash = false
w = PerformRequest(router, http.MethodGet, "/path/") w = PerformRequest(router, http.MethodGet, "/path/")