This is an automated email from the ASF dual-hosted git repository. nic-6443 pushed a commit to branch fix/upstream-uri-crlf in repository https://gitbox.apache.org/repos/asf/apisix.git
commit c93ed5f1925f521d7733d6e61457285a6716ac51 Author: Nic <[email protected]> AuthorDate: Fri Aug 7 12:42:06 2026 +0800 test(proxy-rewrite): assert no header injection in the CRLF-encoding test Strengthen TEST 66: besides asserting the CR/LF is percent-encoded in the upstream request_uri, also assert (response_body_unlike) that no injected x-injected header reached the upstream, so the test is robust against alternative upstream parsing. --- t/plugin/proxy-rewrite.t | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/t/plugin/proxy-rewrite.t b/t/plugin/proxy-rewrite.t index a484409d3..d68ce0f35 100644 --- a/t/plugin/proxy-rewrite.t +++ b/t/plugin/proxy-rewrite.t @@ -1755,7 +1755,9 @@ qr/x-multi: cap-echo\nx-multi: from-src/ } --- request GET /t ---- response_body eval -qr{request_uri: /print_request_received\?orig=/reflect%0[Dd]%0[Aa]X-Injected} +--- response_body_like +request_uri: /print_request_received\?orig=/reflect%0[Dd]%0[Aa]X-Injected:pwn +--- response_body_unlike +x-injected: pwn --- no_error_log [error]
