hanzhenfang opened a new pull request, #14071: URL: https://github.com/apache/apisix/pull/14071
## Summary Backport the URI normalization fix from apache/apisix#14035 to `release/3.18`. The branch contains the upstream PR's current `init.lua` fix, route documentation, and regression cases. This is a draft while #14035 is under review. Nginx matches routes using normalized `$uri`, but an empty `$upstream_uri` can make `proxy_pass` forward the raw request path. For example, `/admin/..%2Fapi/x` matches the public `/api/*` route while the upstream receives the raw path. The change calls `ngx.req.set_uri(uri, false, true)` only when Nginx performed more than decoding/merging slashes, letting Nginx rebuild the request line from the matched path and current args. Plugin rewrites and `proxy-rewrite` retain precedence. ## Local evidence - Official `apache/apisix:3.18.0-debian` image (`sha256:84e6b5e787e9f889ebff88161cb9a16599bafcffa236c6b54c7f779a0655940d`), isolated echo upstream: `curl --path-as-is http://127.0.0.1:35181/admin/..%2Fapi/x` returned `path=/admin/..%2Fapi/x`. - Same image with this branch's `init.lua` mounted: identical request returned `path=/api/x`. Normal `/admin/x` returned 401 in both; info logs show the traversal request matched the `public` route. - Raw HTTP request line `GET /admin/..#x HTTP/1.1`: upstream received `/admin/..#x` before and `/` after. - `key-auth` with `hide_credentials`, serverless query rewrite, `proxy-rewrite`, plain encoded slash and repeated slash controls retained expected outputs. - `git diff --check` and `luajit -bl apisix/init.lua` exited 0. The added Test::Nginx file was not run locally because the Test::Nginx Perl dependency is absent. ## Compatibility and limits Normalized dot-segment paths change what the upstream receives, including possible decoding of adjacent encoded delimiters; this is documented in both router guides. The `normalize_uri_like_servlet` path is outside this change. This backport should be reviewed after #14035 and validated by CI and an official release build before merge. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
