fix(router) use normalized request URI when matching against incoming user requests #6821
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bungle
approved these changes
Feb 9, 2021
user requests Previously Kong's Router have been matching against raw user request URI, that is, URI without being normalized. In this commit we change the behavior of Kong Router to always match against normalized URIs from user. Since Kong Router plays an important role in generating the URI when proxying to the upstream, it means that upstream will always see request URIs after normalization as well. Note that we can not use the `ngx.var.uri` variable directly in normalizing the request URI, because it decodes reserved characters as defined by RFC 3986, which is prohibited by the RFC.
By default, Nginx's proxy module will escape special characters inside the upstream request path when generating the request, however, this behavior is lacking if the request path is overwritten with a variable at the end of the `proxy_pass` directive (which is what Kong does). This PR restores that behavior so that the request Kong generates to the upstream will still follow the HTTP RFC after the router normalization.
dndx
force-pushed
the
fix/router_normalization
branch
from
deca492 to
3440eaa
Compare
kikito
approved these changes
Feb 9, 2021
bungle
added a commit
that referenced
this pull request
Mar 2, 2021
This was referenced Mar 10, 2021
|
Hi @dndx I am trying to figure out whether my stack (which uses Kong 2.0.5) is vulnerable to this security issue. Thank you |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.