A path holding a character Go escapes reaches the app as the client sent it (closes #126) #149

Merged

clawbot merged 1 commits from issue-126-path-as-sent into next

2026-10-20 16:09:48 +02:00

Author	SHA1	Message	Date
sneak	97f1c89243	A path holding a character Go escapes reaches the app as the client sent it (closes #126 ) check / check (push) Waiting to run Details ReverseProxy sends the path URL.EscapedPath gives, which decodes and escapes again a path holding a character such as \|, turning %2F into /. The path as sent now goes in URL.Opaque, which Go sends as it is; the rate limit and WAF exempt paths and the log line's path use the same path. A path starting with // is left as before: Go would send it in Opaque as a scheme and host. Model: opus-5-5	2026-10-20 13:42:08 +00:00

Author

SHA1

Message

Date

sneak

97f1c89243

A path holding a character Go escapes reaches the app as the client sent it (closes #126 )

check / check (push) Waiting to run

Details

ReverseProxy sends the path URL.EscapedPath gives, which decodes and
escapes again a path holding a character such as |, turning %2F into /.
The path as sent now goes in URL.Opaque, which Go sends as it is; the
rate limit and WAF exempt paths and the log line's path use the same
path. A path starting with // is left as before: Go would send it in
Opaque as a scheme and host.

Model: opus-5-5

2026-10-20 13:42:08 +00:00