Skip to content

Commit

Permalink
Safely pass percent symbols in paths.
Browse files Browse the repository at this point in the history
  • Loading branch information
metaskills committed Jul 7, 2023
1 parent f812aad commit 0db0d25
Show file tree
Hide file tree
Showing 5 changed files with 19 additions and 0 deletions.
1 change: 1 addition & 0 deletions lib/lamby/rack_http.rb
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@ def cookies
def path_info
stage = event.dig('requestContext', 'stage')
spath = event.dig('requestContext', 'http', 'path') || event.dig('requestContext', 'path')
spath = event['rawPath'] if spath != event['rawPath'] && !payload_version_one?
spath.sub /\A\/#{stage}/, ''
end

Expand Down
4 changes: 4 additions & 0 deletions test/dummy_app/app/controllers/application_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@ def exception
raise 'hell'
end

def percent
render
end

def cooks
cookies['1'] = '1'
cookies['2'] = '2'
Expand Down
2 changes: 2 additions & 0 deletions test/dummy_app/app/views/application/percent.html.erb
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Params: <%= params[:path] %>
Request Path: <%= request.path %>
1 change: 1 addition & 0 deletions test/dummy_app/config/routes.rb
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
post 'login', to: 'application#login'
delete 'logout', to: 'application#logout'
get 'exception', to: 'application#exception'
get 'percent/*path', to: 'application#percent'
get 'cooks', to: 'application#cooks'
get 'redirect_test', to: redirect('/')
end
11 changes: 11 additions & 0 deletions test/handler_test.rb
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,17 @@ class HandlerTest < LambySpec
expect(result[:body]).must_match %r{We're sorry, but something went wrong.}
expect(result[:body]).must_match %r{This file lives in public/500.html}
end

it 'get - percent' do
event = TestHelpers::Events::HttpV2.create(
'rawPath' => '/production/percent/dwef782jkif%3d',
'requestContext' => { 'http' => {'path' => '/production/percent/dwef782jkif='} }
)
result = Lamby.handler app, event, context, rack: :http
expect(result[:statusCode]).must_equal 200
expect(result[:body]).must_match %r{Params: dwef782jkif=}
expect(result[:body]).must_match %r{Request Path: /percent/dwef782jkif%3}
end

end

Expand Down

0 comments on commit 0db0d25

Please sign in to comment.