gin
gin copied to clipboard
gin-gonic
Prevent multiples encodings in path parameters
Hi guys, I've opened this PR to prevent multiples encodings in path parameters. It solves some security problems about path transversal and multiples encodings.
About the problem:
Imagine if you have the request path.
https://myhost.com/api/cities/:zipcode
It will be hosted by a reverse proxy using a gin engine that delegates the given request to a destination.
Now imagine that the application receives a request like that:
curl -ivk \
$'https://myhost.com/api/cities/anything%c00%25252f..%25252f..%25252f..%25252f..%25252f..%25252fanything%25252fv1%25252fenv%2523'
After the first decode, as gin does, the given URL will be:
https://myhost.com/api/cities/%252f..%252f..%252f..%252f..%252f..%252fanything%252fv1%252fenv%23
Note that the pattern is correct, but the path was not fully decoded, the PR allows gin decode this kind of request.
Is this related to
https://github.com/gin-gonic/gin/issues/2047
Still waiting