chenBright opened a new pull request, #3512:
URL: https://github.com/apache/brpc/pull/3512
### What problem does this PR solve?
Issue Number: resolve
Problem Summary:
Paths that differ only in empty segments dispatched identically.
`FindMethodPropertyByURIImpl` splits
the path with a `StringSplitter` that skips empty fields, so `//flags`,
`/flags//` and `/flags//port` all resolved
to the same method as `/flags`. RFC 3986 treats `//foo` and `/foo` as
distinct paths, so a front proxy whose
ACL matches the collapsed form does not match the padded one and passes it
through — `//flags?setvalue=`
reaches a builtin service that `/flags` cannot. Normalizing the path
server-side would not help, because the
proxy has already forwarded the padded literal; only rejecting it removes
the differential.
The same audit found that HTTP/2 never validated `:path`. RFC 9113 8.3.1
requires it to be non-empty and,
apart from the asterisk-form used by `OPTIONS`, to begin with `/`.
### What is changed and the side effects?
Changed:
- `FindMethodPropertyByURI` rejects any path containing `//`. The check
lives in
the funnel rather than in `FindMethodPropertyByURIImpl`, so it also
covers the
global restful map, which does its own `NormalizeSlashes`.
- `H2StreamContext::ConsumeHeaders` rejects a `:path` that is empty or
does not
begin with `/`, unless it is exactly `*`.
Side effects:
- Performance effects:
- Breaking backward compatibility:
---
### Check List:
- Please make sure your changes are compilable.
- When providing us with a new feature, it is best to add related tests.
- Please follow [Contributor Covenant Code of
Conduct](https://github.com/apache/brpc/blob/master/CODE_OF_CONDUCT.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
