Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merging to release-4-lts: [TT-9327] Decoding the URL request first, before handling any additional logic (#5345) #5736

Merged
merged 2 commits into from
Nov 6, 2023
Merged

Merging to release-4-lts: [TT-9327] Decoding the URL request first, before handling any additional logic (#5345) #5736

merged 2 commits into from
Nov 6, 2023

Conversation

buger
Copy link
Member

@buger buger commented Nov 6, 2023 •
edited by jira bot
Loading

TT-9327 Decoding the URL request first, before handling any additional logic (#5345)

this path works: /payment-intents
but this path doesn't: /payment%2Dintents

Encoded URLs aren't being rewritten when URL rewrite is applied.

One edge case scenario that could break backwards compatibility (as
described by @buger ), is that users can rely on escaped characters, and
try to match them from the the url rewrite rules.

In order to accomodate that, we are running url rewrite middleware
twice:

  • once on the raw path
  • if transformations are failing and the url contains encoded
    characters, then we run it second time, with decoded URL

Related Issue

Motivation and Context

How This Has Been Tested

Unit test and manually

Screenshots (if appropriate)

Types of changes

  • [√ ] Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing
    functionality to change)
  • Refactoring or add test (improvements in base code or adds test
    coverage to functionality)

Checklist

  • I ensured that the documentation is up to date
  • I explained why this PR updates go.mod in detail with reasoning
    why it's required
  • I would like a code coverage CI quality gate exception and have
    explained why

@sweep-ai Sweep AI
Copy link

sweep-ai bot commented Nov 6, 2023

Apply Sweep Rules to your PR?

  • Apply: All new business logic should have corresponding unit tests.
  • Apply: Refactor large functions to be more modular.

@titpetric titpetric marked this pull request as ready for review November 6, 2023 09:55
@buger
Copy link
Member Author

buger commented Nov 6, 2023

API tests result: failure 🚫
Branch used: refs/pull/5736/merge
Commit:
Triggered by: pull_request (@buger)
Execution page

@buger
Copy link
Member Author

buger commented Nov 6, 2023

API tests result: success ✅
Branch used: refs/pull/5736/merge
Commit: bf29a21
Triggered by: pull_request (@titpetric)
Execution page

@titpetric titpetric force-pushed the merge/release-4-lts/4346303f5ed7d3f7ab74a2ecda0666ec81f420e4 branch from bf29a21 to ce9e103 Compare November 6, 2023 10:15
@buger
Copy link
Member Author

buger commented Nov 6, 2023

API tests result: success ✅
Branch used: refs/pull/5736/merge
Commit: ce9e103
Triggered by: pull_request (@titpetric)
Execution page

@buger
Copy link
Member Author

buger commented Nov 6, 2023 •
edited by jira bot
Loading

API tests result: success ✅
Branch used: refs/heads/release-4-lts
Commit: 4ada3e5 TT-10414 [release-4-lts] Fix python coprocess tests, pin protobuf dependency in CI (#5737)

Co-authored-by: Tit Petric tit@tyk.io
Triggered by: push (@titpetric)
Execution page

lghiur and others added 2 commits November 6, 2023 11:46
@lghiur @titpetric
[TT-9327] Decoding the URL request first, before handling any additio…
6723103 
…nal logic (#5345)

<!-- Provide a general summary of your changes in the Title above -->
this path works: /payment-intents
but this path doesn't: /payment%2Dintents

Encoded URLs aren't being rewritten when URL rewrite is applied.

One edge case scenario that could break backwards compatibility (as
described by @buger ), is that users can rely on escaped characters, and
try to match them from the the url rewrite rules.

In order to accomodate that, we are running url rewrite middleware
twice:
- once on the raw path
- if transformations are failing and the url contains encoded
characters, then we run it second time, with decoded URL

<!-- Describe your changes in detail -->

<!-- This project only accepts pull requests related to open issues. -->
<!-- If suggesting a new feature or change, please discuss it in an
issue first. -->
<!-- If fixing a bug, there should be an issue describing it with steps
to reproduce. -->
<!-- OSS: Please link to the issue here. Tyk: please create/link the
JIRA ticket. -->

<!-- Why is this change required? What problem does it solve? -->

Unit test and manually

<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->

- [√ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

<!-- Go over all the following points, and put an `x` in all the boxes
that apply -->
<!-- If there are no documentation updates required, mark the item as
checked. -->
<!-- Raise up any additional concerns not covered by the checklist. -->

- [ ] I ensured that the documentation is up to date
- [ ] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why

(cherry picked from commit 4346303)
@titpetric
Resolve conflicts in util.go, util_test.go
d17ef07
@titpetric titpetric force-pushed the merge/release-4-lts/4346303f5ed7d3f7ab74a2ecda0666ec81f420e4 branch from ce9e103 to d17ef07 Compare November 6, 2023 10:47
@titpetric titpetric enabled auto-merge (squash) November 6, 2023 10:47
@titpetric titpetric merged commit ac2b1c8 into release-4-lts Nov 6, 2023
5 checks passed
@titpetric titpetric deleted the merge/release-4-lts/4346303f5ed7d3f7ab74a2ecda0666ec81f420e4 branch November 6, 2023 10:49
@buger
Copy link
Member Author

buger commented Nov 6, 2023

API tests result: success ✅
Branch used: refs/pull/5736/merge
Commit: d17ef07
Triggered by: pull_request (@titpetric)
Execution page

@buger buger mentioned this pull request Nov 6, 2023
Merged
7 tasks
lghiur added a commit that referenced this pull request Jan 22, 2024
@buger @lghiur
Merging to release-4-lts: [TT-9327] Decoding the URL request first, b…
9be5ac7 
…efore handling any additional logic (#5345) (#5736)

[TT-9327] Decoding the URL request first, before handling any additional
logic (#5345)

<!-- Provide a general summary of your changes in the Title above -->
this path works: /payment-intents
but this path doesn't: /payment%2Dintents

Encoded URLs aren't being rewritten when URL rewrite is applied.

One edge case scenario that could break backwards compatibility (as
described by @buger ), is that users can rely on escaped characters, and
try to match them from the the url rewrite rules.

In order to accomodate that, we are running url rewrite middleware
twice:
- once on the raw path
- if transformations are failing and the url contains encoded
characters, then we run it second time, with decoded URL

<!-- Describe your changes in detail -->


## Related Issue

<!-- This project only accepts pull requests related to open issues. -->
<!-- If suggesting a new feature or change, please discuss it in an
issue first. -->
<!-- If fixing a bug, there should be an issue describing it with steps
to reproduce. -->
<!-- OSS: Please link to the issue here. Tyk: please create/link the
JIRA ticket. -->

## Motivation and Context

<!-- Why is this change required? What problem does it solve? -->

## How This Has Been Tested

Unit test and manually

## Screenshots (if appropriate)

## Types of changes

<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->

- [√ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Refactoring or add test (improvements in base code or adds test
coverage to functionality)

## Checklist

<!-- Go over all the following points, and put an `x` in all the boxes
that apply -->
<!-- If there are no documentation updates required, mark the item as
checked. -->
<!-- Raise up any additional concerns not covered by the checklist. -->

- [ ] I ensured that the documentation is up to date
- [ ] I explained why this PR updates go.mod in detail with reasoning
why it's required
- [ ] I would like a code coverage CI quality gate exception and have
explained why

[TT-9327]:
https://tyktech.atlassian.net/browse/TT-9327?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

---------

Co-authored-by: Laurentiu Ghiur <laurentiu.ghiur@gmail.com>
Co-authored-by: Tit Petric <tit@tyk.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@buger @titpetric @lghiur