From 76b74e34c20dfaf25e491571044655e3fdf39c19 Mon Sep 17 00:00:00 2001
From: Erik Dubbelboer <erik@dubbelboer.com>
Date: Fri, 28 Feb 2020 18:56:02 +0100
Subject: [PATCH] Don't send the fragment/hash/# part of a URL to the server

Fixes https://github.com/valyala/fasthttp/issues/748
---
 http_test.go | 15 +++++++++++++++
 uri.go       | 11 ++++++-----
 uri_test.go  | 19 +++++++++++--------
 3 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/http_test.go b/http_test.go
index e5f5431102..2c9be2af58 100644
--- a/http_test.go
+++ b/http_test.go
@@ -15,6 +15,21 @@ import (
 	"github.com/valyala/bytebufferpool"
 )
 
+// Don't send the fragment/hash/# part of a URL to the server.
+func TestFragmentInURIRequest(t *testing.T) {
+	var req Request
+	req.SetRequestURI("https://docs.gitlab.com/ee/user/project/integrations/webhooks.html#events")
+
+	var b bytes.Buffer
+	req.WriteTo(&b)
+	got := b.String()
+	expected := "GET /ee/user/project/integrations/webhooks.html HTTP/1.1\r\nHost: docs.gitlab.com\r\n\r\n"
+
+	if got != expected {
+		t.Errorf("got %q expected %q", got, expected)
+	}
+}
+
 func TestRequestCopyTo(t *testing.T) {
 	t.Parallel()
 
diff --git a/uri.go b/uri.go
index 80e5bf3b6f..c9a81d4cfc 100644
--- a/uri.go
+++ b/uri.go
@@ -401,10 +401,6 @@ func (u *URI) RequestURI() []byte {
 		dst = append(dst, '?')
 		dst = append(dst, u.queryString...)
 	}
-	if len(u.hash) > 0 {
-		dst = append(dst, '#')
-		dst = append(dst, u.hash...)
-	}
 	u.requestURI = dst
 	return u.requestURI
 }
@@ -519,7 +515,12 @@ func (u *URI) FullURI() []byte {
 // AppendBytes appends full uri to dst and returns the extended dst.
 func (u *URI) AppendBytes(dst []byte) []byte {
 	dst = u.appendSchemeHost(dst)
-	return append(dst, u.RequestURI()...)
+	dst = append(dst, u.RequestURI()...)
+	if len(u.hash) > 0 {
+		dst = append(dst, '#')
+		dst = append(dst, u.hash...)
+	}
+	return dst
 }
 
 func (u *URI) appendSchemeHost(dst []byte) []byte {
diff --git a/uri_test.go b/uri_test.go
index 06d75263ee..9c4a67b71e 100644
--- a/uri_test.go
+++ b/uri_test.go
@@ -274,18 +274,18 @@ func testURIFullURI(t *testing.T, scheme, host, path, hash string, args *Args, e
 }
 
 func TestURIParseNilHost(t *testing.T) {
-	testURIParseScheme(t, "http://google.com/foo?bar#baz", "http", "google.com", "/foo?bar#baz")
-	testURIParseScheme(t, "HTtP://google.com/", "http", "google.com", "/")
-	testURIParseScheme(t, "://google.com/xyz", "http", "google.com", "/xyz")
-	testURIParseScheme(t, "//google.com/foobar", "http", "google.com", "/foobar")
-	testURIParseScheme(t, "fTP://aaa.com", "ftp", "aaa.com", "/")
-	testURIParseScheme(t, "httPS://aaa.com", "https", "aaa.com", "/")
+	testURIParseScheme(t, "http://google.com/foo?bar#baz", "http", "google.com", "/foo?bar", "baz")
+	testURIParseScheme(t, "HTtP://google.com/", "http", "google.com", "/", "")
+	testURIParseScheme(t, "://google.com/xyz", "http", "google.com", "/xyz", "")
+	testURIParseScheme(t, "//google.com/foobar", "http", "google.com", "/foobar", "")
+	testURIParseScheme(t, "fTP://aaa.com", "ftp", "aaa.com", "/", "")
+	testURIParseScheme(t, "httPS://aaa.com", "https", "aaa.com", "/", "")
 
 	// missing slash after hostname
-	testURIParseScheme(t, "http://foobar.com?baz=111", "http", "foobar.com", "/?baz=111")
+	testURIParseScheme(t, "http://foobar.com?baz=111", "http", "foobar.com", "/?baz=111", "")
 }
 
-func testURIParseScheme(t *testing.T, uri, expectedScheme, expectedHost, expectedRequestURI string) {
+func testURIParseScheme(t *testing.T, uri, expectedScheme, expectedHost, expectedRequestURI, expectedHash string) {
 	var u URI
 	u.Parse(nil, []byte(uri))
 	if string(u.Scheme()) != expectedScheme {
@@ -297,6 +297,9 @@ func testURIParseScheme(t *testing.T, uri, expectedScheme, expectedHost, expecte
 	if string(u.RequestURI()) != expectedRequestURI {
 		t.Fatalf("Unexepcted requestURI %q. Expecting %q for uri %q", u.RequestURI(), expectedRequestURI, uri)
 	}
+	if string(u.hash) != expectedHash {
+		t.Fatalf("Unexepcted hash %q. Expecting %q for uri %q", u.hash, expectedHash, uri)
+	}
 }
 
 func TestURIParse(t *testing.T) {