Skip to content

Commit

Permalink
fix: Normalize location path to avoid multiple forward slashes
Browse files Browse the repository at this point in the history
  • Loading branch information
dav-pascual committed Mar 6, 2023
1 parent c7db9c9 commit e750aa8
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 5 deletions.
7 changes: 7 additions & 0 deletions common/etc/nginx/templates/default.conf.template
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,13 @@ server {
# information that could be used to find an exploit.
server_tokens off;

# Normalize location path. Remove instances of double/multipe forward slashes.
# Disabling merge_slashes is necessary for this feature to work.
# Disabling port redirection to avoid broken URLs in bridged hosts
port_in_redirect off;
merge_slashes off;
rewrite (.*?)//+(.*) $1/$2 redirect;

# Uncomment this for a HTTP header that will let you know the cache status
# of an object.
# add_header X-Cache-Status $upstream_cache_status;
Expand Down
6 changes: 1 addition & 5 deletions test/integration/test_api.sh
Original file line number Diff line number Diff line change
Expand Up @@ -153,7 +153,7 @@ assertHttpRequestEquals "HEAD" "a.txt?some=param&that=should&be=stripped#aaah" "
assertHttpRequestEquals "HEAD" "b/c/d.txt" "200"
assertHttpRequestEquals "HEAD" "b/c/../e.txt" "200"
assertHttpRequestEquals "HEAD" "b/e.txt" "200"
assertHttpRequestEquals "HEAD" "b//e.txt" "200"
assertHttpRequestEquals "HEAD" "b//e.txt" "302"
assertHttpRequestEquals "HEAD" "a/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.txt" "200"

# We try to request URLs that are properly encoded as well as URLs that
Expand Down Expand Up @@ -220,11 +220,7 @@ fi
assertHttpRequestEquals "HEAD" "b/" "404"
assertHttpRequestEquals "HEAD" "/b/c/" "404"
assertHttpRequestEquals "HEAD" "/soap" "404"
if [ "${append_slash}" == "1" ] && [ "${index_page}" == "0" ]; then
assertHttpRequestEquals "HEAD" "b//c" "302"
else
assertHttpRequestEquals "HEAD" "b//c" "404"
fi

if [ "${index_page}" == "1" ]; then
assertHttpRequestEquals "HEAD" "/statichost/" "200"
Expand Down

0 comments on commit e750aa8

Please sign in to comment.