Not able to rewrite the query string using Network.Wai.Middleware.Rewrite

[zachary822]

https://hackage.haskell.org/package/wai-extra-3.1.13.0/docs/Network-Wai-Middleware-Rewrite.html

This only updates the Request.queryString and doesn't update Request.rawQueryString, therefore scotty routes don't pickup on the rewritten queryString and continues to read from the old rawQueryString.

According to https://hackage.haskell.org/package/wai-3.2.3/docs/Network-Wai.html#v:rawQueryString rawQueryString should not be modified.

I'm thinking we should read from queryString instead, to allow for people that need to modify the queryString while keeping rawQueryString read-only.

[ocramz]

Thank you for filing this!

On Tue, 28 Nov 2023 at 00:13, Zachary Juang @.***> wrote:

https://hackage.haskell.org/package/wai-extra-3.1.13.0/docs/Network-Wai-Middleware-Rewrite.html

This only updates the Request.queryString and doesn't update Request.rawQueryString, therefore scotty routes don't pickup on the rewritten queryString and continues to read from the old rawQueryString.

According to https://hackage.haskell.org/package/wai-3.2.3/docs/Network-Wai.html#v:rawQueryString rawQueryString should not be modified.

I'm thinking we should read from queryString instead, to allow for people that need to modify the queryString while keeping rawQueryString read-only.

— Reply to this email directly, view it on GitHub https://github.com/scotty-web/scotty/issues/348, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABNBDKF5FJF65KUX3S2FFZTYGSU2BAVCNFSM6AAAAAA74GG3ZOVHI2DSMVQWIX3LMV43ASLTON2WKOZSGAYTENBZHAZDSMQ . You are receiving this because you are subscribed to this thread.Message ID: @.***>

[ocramz]

@zachary822 would you be able to provide a minimal repro for this? Thanks!

[zachary822]

Code:

{-# LANGUAGE OverloadedStrings #-}

module Main where

import Debug.Trace
import Network.Wai
import Web.Scotty

rewriteMiddleware app req sendResponse = do
  app req{queryString = [("a", Just "b")]} sendResponse

main :: IO ()
main = do
  scotty 3000 $ do
    middleware rewriteMiddleware

    get "/" $ do
      p <- queryParams
      req <- request
      traceShowM p
      traceShowM req
      text "riveting content!"

Stdout:

Setting phasers to stun... (port 3000) (ctrl-c to quit)
[]
Request {requestMethod = "GET", httpVersion = HTTP/1.1, rawPathInfo = "/", rawQueryString = "", requestHeaders = [("Host","localhost:3000"),("User-Agent","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:120.0) Gecko/20100101 Firefox/120.0"),("Accept","text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"),("Accept-Language","en-US,en;q=0.5"),("Accept-Encoding","gzip, deflate, br"),("DNT","1"),("Connection","keep-alive"),("Upgrade-Insecure-Requests","1"),("Sec-Fetch-Dest","document"),("Sec-Fetch-Mode","navigate"),("Sec-Fetch-Site","none"),("Sec-Fetch-User","?1")], isSecure = False, remoteHost = 127.0.0.1:50733, pathInfo = [], queryString = [("a",Just "b")], requestBody = <IO ByteString>, vault = <Vault>, requestBodyLength = KnownLength 0, requestHeaderHost = Just "localhost:3000", requestHeaderRange = Nothing}

[ocramz]

The solution seems to be fixing this line only: https://github.com/scotty-web/scotty/blob/e6a97352229d9e1811193ff93d2eccf7e1ab9526/Web/Scotty/Route.hs#L163C22-L163C22

[zachary822]

I made a simple fix.