Merge pull request #44 from zazuko/slashes

Test Slashes

test/app/src/index.ts

@@ -1,6 +1,35 @@
 import fastify from "fastify";
 import fastifyFormbody from "@fastify/formbody";
 
+/**
+ * Cleanup header value.
+ * Returns default value if the header value is not a string or is empty or too long (more than 256 characters long).
+ *
+ * @param headerValue Value of the header
+ * @param defaultValue Default value of the header
+ * @returns Cleaned up header value
+ */
+const cleanupHeaderValue = (
+  headerValue: string,
+  defaultValue: string
+): string => {
+  if (typeof headerValue !== "string") {
+    return defaultValue;
+  }
+
+  // Split, remove all lines except the first one (can be CRLF, LF or CR), trim, and return
+  const newValue = headerValue.split(/\r\n|\r|\n/)[0].trim();
+  if (newValue.length === 0) {
+    return defaultValue;
+  }
+  if (newValue.length > 256) {
+    return defaultValue;
+  }
+
+  // Support URL encoded values
+  return decodeURIComponent(newValue);
+};
+
 // Fetch values from environment variables
 const port = process.env.SERVER_PORT || 8080;
 const host = process.env.SERVER_HOST || "::";
@@ -32,15 +61,15 @@ server.all<{
 });
 
 // Return a specific xkey header
-server.all<{
-  Params: {
-    headerValue: string;
-  };
-}>("/x-header/:headerValue", async (request, reply) => {
-  return reply.header("xkey", request.params.headerValue).send({
+server.all("/x-header/*", async (request, reply) => {
+  const path =
+    request.raw.url?.split("?")[0].split("/").slice(2).join("/") || "";
+  const xkeyValue = cleanupHeaderValue(path, "default");
+
+  return reply.header("xkey", xkeyValue).send({
     hello: "xkey header",
     time: Date.now(),
-    value: request.params.headerValue,
+    value: xkeyValue,
   });
 });
 

test/run.sh

@@ -317,6 +317,28 @@ if [ "${req5}" -ne "${req8}" ]; then
   error "should be the same"
 fi
 
+# Just try with xkey with slashes
+req1=$(curl -sL -X POST --data '{"foo": "bar"}' http://localhost:8081/x-header/http://example.com/custom/path | jq .time)
+req2=$(curl -sL -X POST --data '{"foo": "bar"}' http://localhost:8081/x-header/http://example.com/custom/path | jq .time)
+req3=$(curl -sL -X POST --data '{"foo": "bar"}' http://localhost:8081/x-header/http%3A%2F%2Fexample.com%2Fcustom%2Fpath | jq .time)
+req4=$(curl -sL -X POST --data '{"foo": "bar"}' http://localhost:8081/x-header/http%3A%2F%2Fexample.com%2Fcustom%2Fpath | jq .time)
+if [ "${req1}" -ne "${req2}" ]; then
+  error "should be the same - url with slashes"
+fi
+if [ "${req3}" -ne "${req4}" ]; then
+  error "should be the same - encoded url with slashes"
+fi
+# Clear cache
+curl -sL -X PURGE -H 'xkey: http://example.com/custom/path' http://localhost:8081/ >/dev/null
+req5=$(curl -sL -X POST --data '{"foo": "bar"}' http://localhost:8081/x-header/http://example.com/custom/path | jq .time)
+req6=$(curl -sL -X POST --data '{"foo": "bar"}' http://localhost:8081/x-header/http%3A%2F%2Fexample.com%2Fcustom%2Fpath | jq .time)
+if [ "${req1}" -eq "${req5}" ]; then
+  error "should not be the same - url with slashes"
+fi
+if [ "${req3}" -eq "${req6}" ]; then
+  error "should not be the same - encoded url with slashes"
+fi
+
 # If we are at this point, no test failed
 info "All tests passed :)"
 docker compose down