git.iko.soy/typeable/oauth2-proxy
on master help sign in
Enable UseEncodedPath() for frontend mux
ae72bebFabian Stelzer
oauthproxy.go+3−1
compare with master
unifiedsplit
@@ -265,7 +265,9 @@ func (p *OAuthProxy) setupServer(opts *options.Options) error {
265}
265}
266
266
267func (p *OAuthProxy) buildServeMux(proxyPrefix string) {
267func (p *OAuthProxy) buildServeMux(proxyPrefix string) {
268+ // Use the encoded path here so we can have the option to pass it on in the upstream mux.
269+ // Otherwise something like /%2F/ would be redirected to / here already.
268− r := mux.NewRouter()
270+ r := mux.NewRouter().UseEncodedPath()
269 // Everything served by the router must go through the preAuthChain first.
271 // Everything served by the router must go through the preAuthChain first.
270 r.Use(p.preAuthChain.Then)
272 r.Use(p.preAuthChain.Then)
271
273
oauthproxy_test.go+9
@@ -915,6 +915,15 @@ func TestUserInfoEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
915 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
915 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
916}
916}
917
917
918+func TestEncodedUrlsStayEncoded(t *testing.T) {
919+ encodeTest, err := NewSignInPageTest(false)
920+ if err != nil {
921+ t.Fatal(err)
922+ }
923+ code, _ := encodeTest.GetEndpoint("/%2F/test1/%2F/test2")
924+ assert.Equal(t, 403, code)
925+}
926+
918func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
927func NewAuthOnlyEndpointTest(querystring string, modifiers ...OptionsModifier) (*ProcessCookieTest, error) {
919 pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)
928 pcTest, err := NewProcessCookieTestWithOptionsModifiers(modifiers...)
920 if err != nil {
929 if err != nil {