rewrite now puts the path as the client sent it in the outgoing URL.Opaque, which Go writes to the app as it is. That path is the one rules.Path already gives the rule files and SWWAF_TRAP_PATHS. Before, ReverseProxy wrote the path URL.EscapedPath gives. For a path holding a character Go escapes, such as |, ^ or a byte above 127, that is the whole path decoded and escaped again: /a%2Fb|c reached the app as /a/b%7Cc.
pathExempt, for SWWAF_RATE_LIMIT_EXEMPT_PATHS and SWWAF_WAF_EXEMPT_PATHS, and the log line's path now read that same path. So /assets/x%2Fy|z is never exempt, as README.md says, and the log shows the path as it was sent.
What the diff does not show: Go writes an Opaque starting with // as scheme://…, so the app would get an absolute URL naming another host. A path starting with // is therefore still sent the old way, through EscapedPath, and the test sends //a%2Fb to keep it so. A target that is not a path, * or a CONNECT authority, is not touched either.
Deviation: a path starting with // that holds a character Go escapes still reaches the app re-encoded, because Go's HTTP client cannot write it as sent. README.md now says so under "What it does so far".
Judgement call, not covered by a test: for a CONNECT request, the log line's path is now the authority as sent, where it was empty.
Model: opus-5-5
`rewrite` now puts the path as the client sent it in the outgoing `URL.Opaque`, which Go writes to the app as it is. That path is the one `rules.Path` already gives the rule files and `SWWAF_TRAP_PATHS`. Before, ReverseProxy wrote the path `URL.EscapedPath` gives. For a path holding a character Go escapes, such as `|`, `^` or a byte above 127, that is the whole path decoded and escaped again: `/a%2Fb|c` reached the app as `/a/b%7Cc`.
`pathExempt`, for `SWWAF_RATE_LIMIT_EXEMPT_PATHS` and `SWWAF_WAF_EXEMPT_PATHS`, and the log line's `path` now read that same path. So `/assets/x%2Fy|z` is never exempt, as `README.md` says, and the log shows the path as it was sent.
What the diff does not show: Go writes an `Opaque` starting with `//` as `scheme://…`, so the app would get an absolute URL naming another host. A path starting with `//` is therefore still sent the old way, through `EscapedPath`, and the test sends `//a%2Fb` to keep it so. A target that is not a path, `*` or a CONNECT authority, is not touched either.
- Deviation: a path starting with `//` that holds a character Go escapes still reaches the app re-encoded, because Go's HTTP client cannot write it as sent. `README.md` now says so under "What it does so far".
- Judgement call, not covered by a test: for a CONNECT request, the log line's `path` is now the authority as sent, where it was empty.
Model: opus-5-5
ReverseProxy sends the path URL.EscapedPath gives, which decodes and
escapes again a path holding a character such as |, turning %2F into /.
The path as sent now goes in URL.Opaque, which Go sends as it is; the
rate limit and WAF exempt paths and the log line's path use the same
path. A path starting with // is left as before: Go would send it in
Opaque as a scheme and host.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
rewritenow puts the path as the client sent it in the outgoingURL.Opaque, which Go writes to the app as it is. That path is the onerules.Pathalready gives the rule files andSWWAF_TRAP_PATHS. Before, ReverseProxy wrote the pathURL.EscapedPathgives. For a path holding a character Go escapes, such as|,^or a byte above 127, that is the whole path decoded and escaped again:/a%2Fb|creached the app as/a/b%7Cc.pathExempt, forSWWAF_RATE_LIMIT_EXEMPT_PATHSandSWWAF_WAF_EXEMPT_PATHS, and the log line'spathnow read that same path. So/assets/x%2Fy|zis never exempt, asREADME.mdsays, and the log shows the path as it was sent.What the diff does not show: Go writes an
Opaquestarting with//asscheme://…, so the app would get an absolute URL naming another host. A path starting with//is therefore still sent the old way, throughEscapedPath, and the test sends//a%2Fbto keep it so. A target that is not a path,*or a CONNECT authority, is not touched either.//that holds a character Go escapes still reaches the app re-encoded, because Go's HTTP client cannot write it as sent.README.mdnow says so under "What it does so far".pathis now the authority as sent, where it was empty.Model: opus-5-5
PASS
Model: opus-5-5