krakend / krakend-ce

KrakenD Community Edition: High-performance, stateless, declarative, API Gateway written in Go.
https://www.krakend.io
Apache License 2.0
1.94k stars 453 forks source link

mishandling of percent character in path component #862

Closed nsitbon closed 6 months ago

nsitbon commented 6 months ago

Hi, I'm trying to send a percent character properly encoded inside a path component but Krakend returns an error in that case :

curl -i 'http://localhost:8080/foo/%25'
HTTP/1.1 400 Bad Request
Date: Fri, 22 Mar 2024 16:20:53 GMT
Content-Length: 29
Content-Type: text/plain; charset=utf-8

error: invalid URL escape "%"

configuration file:

{
    "$schema": "https://www.krakend.io/schema/v2.5/krakend.json",
    "version": 3,
    "port": 8080,
    "endpoints": [
        {
            "endpoint": "/foo/{id}",
            "method": "GET",
            "backend": [
                {
                    "host": ["http://127.0.0.1:8000"],
                    "url_pattern": "/foo/{id}"
                }
            ]
        }
    ]
}

I run it with

./krakend run -c krakend.json

The backend is not involved as it's not even touched. Nothing inside the log though.

kpacha commented 6 months ago

maybe you're looking for this? https://www.krakend.io/docs/service-settings/router-options/#disable_path_decoding

nsitbon commented 6 months ago

maybe you're looking for this? https://www.krakend.io/docs/service-settings/router-options/#disable_path_decoding

not sure : I don't really understand the purpose of this option I mean I still want validation and this request is perfectly valid so what is the purpose of disable_path_decoding?

nsitbon commented 6 months ago

You closed the issue to soon: I find the culprit => https://github.com/luraproject/lura/blob/master/router/gin/engine.go#L142 you're unescaping a param which appear to be already unescaped : using the debugger I printed the value which is '%' and not '%25' as it should be!