From: Jerome Magnin <jmagnin@haproxy.com>
Date: Fri, 21 Feb 2020 09:37:48 +0000 (+0100)
Subject: BUG/MINOR: http: http-request replace-path duplicates the query string
X-Git-Tag: v2.2-dev3~36
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4bbc9494b75b6f987c813546c1fa79a5e883a188;p=thirdparty%2Fhaproxy.git

BUG/MINOR: http: http-request replace-path duplicates the query string

In http_action_replace_uri() we call http_get_path() in the case of
a replace-path rule. http_get_path() will return an ist pointing to
the start of the path, but uri.ptr + uri.len points to the end of the
uri. As as result, we are matching against a string containing the
query, which we append to the "path" later, effectively duplicating
the query string.

This patch uses the iststop() function introduced in "MINOR: ist: add
an iststop() function" to find the '?' character and update the ist
length when needed.

This fixes issue #510.

The bug was introduced by commit 262c3f1a ("MINOR: http: add a new
"replace-path" action"), which was backported to 2.1 and 2.0.
---

diff --git a/src/http_act.c b/src/http_act.c
index 7185014165..c4a7ad4a7b 100644
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -202,7 +202,7 @@ static enum act_return http_action_replace_uri(struct act_rule *rule, struct pro
 	uri = htx_sl_req_uri(http_get_stline(htxbuf(&s->req.buf)));
 
 	if (rule->action == 1) // replace-path
-		uri = http_get_path(uri);
+		uri = iststop(http_get_path(uri), '?');
 
 	if (!regex_exec_match2(rule->arg.http.re, uri.ptr, uri.len, MAX_MATCH, pmatch, 0))
 		goto leave;