Uploaded image for project: 'Red Hat 3scale API Management'
  1. Red Hat 3scale API Management
  2. THREESCALE-5117

Special characters in the backend usage path result in wrong routing

XMLWordPrintable

    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Not Started
    • Engineering
    • No

      /// dev notes: has been partially fixed. only %20", "%22", "%3C", "%3E", "%7C pending 

       

      I have one product with multiple backends.
      Each backend is connected via path '/foo<special character>bar'.

      It will be routed correctly if the <special character> is any of these characters:

      ["-", "_", "~", "!", "&", ",", ";", "=", "@", "/"]
      

      If I add another backend with path /foo.bar, it will break routing to other backends, i.e /foo-bar will be routed to the backend of /foo.bar path.

      If I add another backend with path /foo'bar, it will be routed correctly but, apicast is logging errors:

      2020/04/28 17:27:57 [error] 20#20: *4738 [lua] template_string.lua:99: new(): Invalid Liquid: {{uri | remove_first: '/foo'bar'}} It will be evaluated to empty string. Error: /usr/local/share/lua/5.1/liquid.lua:1158: Invalid syntax: parsing stoped at: line 1 cols: 31 current_token is Token(ID,bar)
       info: expect var_end '}}' or '-}}' , client: 10.130.0.1, server: _, request: "GET /a'print('c')--?user_key=3c3d801727285a0f056c25cb3a042e1a HTTP/1.1", host: "svc-jsmadis-test-cse-pcly-3scale-apicast-staging.<URL>"
      

      There is a list of characters that resulted in 404 status code:

      ["$" ,"(" , ")" , "*", "+", "%", "%20", "%22", "%3C", "%3E", "%7C"]
      

      Where last 5 characters are encoded.

      %20 = space
      %22 = "
      %3C = <
      %3E = >
      %7C = |
      

      Any path /foo<special character>bar mentioned here can be created via 3scale API

            Unassigned Unassigned
            jsmadis Jakub Smadis (Inactive)
            Jakub Smolár Jakub Smolár
            Votes:
            3 Vote for this issue
            Watchers:
            11 Start watching this issue

              Created:
              Updated:
              Resolved: