diff --git a/kong/resolver/access.lua b/kong/resolver/access.lua index 75938dc92ea..70bbe18d80e 100644 --- a/kong/resolver/access.lua +++ b/kong/resolver/access.lua @@ -166,7 +166,8 @@ function _M.execute(conf) if by_path and api.strip_path then -- Replace `/path` with `path`, and then prefix with a `/` -- Or replace `/path/foo` with `/foo`, and then do not prefix with `/`. - request_uri = string.gsub(request_uri, api.path, "") + local escaped_path = api.path:gsub("[%(%)%.%%%+%-%*%?%[%]%^%$]", function(c) return "%" .. c end) + request_uri = string.gsub(request_uri, escaped_path, "") if string.sub(request_uri, 0, 1) ~= "/" then request_uri = "/"..request_uri end diff --git a/spec/integration/proxy/api_resolver_spec.lua b/spec/integration/proxy/api_resolver_spec.lua index 22e27502afb..951ce63ae88 100644 --- a/spec/integration/proxy/api_resolver_spec.lua +++ b/spec/integration/proxy/api_resolver_spec.lua @@ -29,6 +29,7 @@ describe("Resolver", function() {name = "tests host resolver 2", public_dns = "mockbin-auth.com", target_url = "http://mockbin.com"}, {name = "tests path resolver", target_url = "http://mockbin.com", path = "/status/"}, {name = "tests stripped path resolver", target_url = "http://mockbin.com", path = "/mockbin/", strip_path = true}, + {name = "tests stripped path resolver with magic", target_url = "http://mockbin.com", path = "/mockbin-with-magic/", strip_path = true}, {name = "tests deep path resolver", target_url = "http://mockbin.com", path = "/deep/path/", strip_path = true}, {name = "tests wildcard subdomain", target_url = "http://mockbin.com/status/200", public_dns = "*.wildcard.com"}, {name = "tests wildcard subdomain 2", target_url = "http://mockbin.com/status/201", public_dns = "wildcard.*"} @@ -162,6 +163,13 @@ describe("Resolver", function() assert.equal("http://mockbin.com/request", body.url) end) + it("should proxy and strip the path if `strip_path` is true if path has magic characters", function() + local response, status = http_client.get(spec_helper.PROXY_URL.."/mockbin-with-magic/request") + assert.equal(200, status) + local body = cjson.decode(response) + assert.equal("http://mockbin.com/request", body.url) + end) + it("should proxy when the path has a deep level", function() local _, status = http_client.get(spec_helper.PROXY_URL.."/deep/path/status/200") assert.equal(200, status)