re-escape urls to avoid mixed-case hex from input url

ipfs · Jan 8, 2025 · ffce1d8 · ffce1d8
1 parent 2adbe37
commit ffce1d8
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/gateway/handler_codec.go b/gateway/handler_codec.go
@@ -172,6 +172,11 @@ func (i *handler) serveCodecHTML(ctx context.Context, w http.ResponseWriter, r *
 		if r.URL.RawQuery != "" {
 			suffix = suffix + "?" + url.PathEscape(r.URL.RawQuery)
 		}
+		// Re-escape path instead of reusing RawPath to avod mix of lawer
+		// and upper hex that may come from RawPath.
+		if strings.IndexRune(requestURI.RawPath, '%') != -1 {
+			requestURI.RawPath = ""
+		}
 		// /ipfs/cid/foo?bar must be redirected to /ipfs/cid/foo/?bar
 		redirectURL := requestURI.EscapedPath() + suffix
 		http.Redirect(w, r, redirectURL, http.StatusMovedPermanently)

diff --git a/gateway/handler_unixfs_dir.go b/gateway/handler_unixfs_dir.go
@@ -49,9 +49,15 @@ func (i *handler) serveDirectory(ctx context.Context, w http.ResponseWriter, r *
 			if r.URL.RawQuery != "" {
 				suffix = suffix + "?" + url.PathEscape(r.URL.RawQuery)
 			}
+			// Re-escape path instead of reusing RawPath to avod mix of lawer
+			// and upper hex that may come from RawPath.
+			if strings.IndexRune(requestURI.RawPath, '%') != -1 {
+				requestURI.RawPath = ""
+			}
 			// /ipfs/cid/foo?bar must be redirected to /ipfs/cid/foo/?bar
 			redirectURL := requestURI.EscapedPath() + suffix
 			rq.logger.Debugw("directory location moved permanently", "status", http.StatusMovedPermanently)
+
 			http.Redirect(w, r, redirectURL, http.StatusMovedPermanently)
 			return true
 		}