Skip to content

Commit

Permalink
Prevent double decoding of % in url params
Browse files Browse the repository at this point in the history
There was an unfortunate regression in #14293 which has led to the double decoding
of url parameter elements if they contain a '%'. This is due to an issue
with the way chi decodes its RoutePath. In detail the problem lies in
mux.go where the routeHTTP path uses the URL.RawPath or even the
URL.Path instead of the escaped path to do routing.

This PR simply forcibly sets the routePath to that of the EscapedPath.

Fix #17938

Signed-off-by: Andrew Thornton <art27@cantab.net>
  • Loading branch information
zeripath committed Dec 15, 2021
1 parent f58e687 commit 4298560
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions modules/context/context.go
Original file line number Diff line number Diff line change
Expand Up @@ -609,6 +609,10 @@ func Contexter() func(next http.Handler) http.Handler {
var locale = middleware.Locale(resp, req)
var startTime = time.Now()
var link = setting.AppSubURL + strings.TrimSuffix(req.URL.EscapedPath(), "/")

chiCtx := chi.RouteContext(req.Context())
chiCtx.RoutePath = req.URL.EscapedPath()

var ctx = Context{
Resp: NewResponse(resp),
Cache: mc.GetCache(),
Expand Down

0 comments on commit 4298560

Please sign in to comment.