From f6d05266852e8a46b8ef060e249c05c577a926f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=B0lteri=C5=9F=20Ya=C4=9F=C4=B1ztegin=20Ero=C4=9Flu?= <84010930+ilteriseroglu-ty@users.noreply.github.com> Date: Fri, 23 Dec 2022 17:08:18 +0300 Subject: [PATCH] fix(proxy-rewrite): fix url normalization bypass MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit fixes a bug where ctx.var.upstream_uri is not set when use_real_request_uri_unsafe is enabled. It seems that somewhere in the runtime chain (LuaJIT?) a memory jump occurs and ctx.var.upstream_uri _does_ get set even though it definitely **shouldn't**. Hence why this got unnoticed in the CI tests of #7401. Signed-off-by: İlteriş Yağıztegin Eroğlu --- apisix/plugins/proxy-rewrite.lua | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apisix/plugins/proxy-rewrite.lua b/apisix/plugins/proxy-rewrite.lua index fdb8c81840d0..f468532c5cdf 100644 --- a/apisix/plugins/proxy-rewrite.lua +++ b/apisix/plugins/proxy-rewrite.lua @@ -297,6 +297,8 @@ do else ctx.var.upstream_uri = upstream_uri end + else + ctx.var.upstream_uri = upstream_uri end if conf.headers then