Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: case insensitive comparison for RawPath to resolve incorrect rPath assignments #4092

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

iIIusi0n
Copy link

@iIIusi0n iIIusi0n commented Nov 11, 2024

Go's standard url package doesn't assign RawPath if the escaped path is the same as the original path.
But for lower case escaped path, like "%ed%95%ab", it assumes they are different from escaped original path "%ED%95%AB".
So it assigns RawPath to "%ed%95%ab".
This has already been discussed in Go, but they said it works as intended.
net/http: RawPath shows inconsistent case-sensitive behaviour with percentage-encoded Unicode URI strings

Golang Gin checks the length of URL.RawPath when engine.UseRawPath is enabled.
If a percentage-encoded lower-case path is given, it redirects indefinitely. (Issue: #4034)

So add checks that compare RawPath and EscapedPath() with case insensitivity.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant