fix: case insensitive comparison for RawPath to resolve incorrect rPath assignments #4092
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Go's standard url package doesn't assign
RawPath
if the escaped path is the same as the original path.But for lower case escaped path, like "%ed%95%ab", it assumes they are different from escaped original path "%ED%95%AB".
So it assigns
RawPath
to "%ed%95%ab".This has already been discussed in Go, but they said it works as intended.
net/http: RawPath shows inconsistent case-sensitive behaviour with percentage-encoded Unicode URI strings
Golang Gin checks the length of
URL.RawPath
whenengine.UseRawPath
is enabled.If a percentage-encoded lower-case path is given, it redirects indefinitely. (Issue: #4034)
So add checks that compare
RawPath
andEscapedPath()
with case insensitivity.