Copilot commented on code in PR #13708:
URL: https://github.com/apache/trafficserver/pull/13708#discussion_r4236598245
##########
plugins/experimental/access_control/access_control.cc:
##########
@@ -23,12 +23,120 @@
#include <iostream>
#include <string>
+#include <charconv>
#include "access_control.h"
size_t calcMessageDigest(const StringView hf, const char *secret, const char
*message, size_t messageLen, char *buffer, size_t len);
const char *getSecretMap(const StringMap &map, const StringView &key, size_t
&secretSize);
+static bool
+normalizePath(StringView path, String &normalized, bool isScope = false)
+{
+ normalized.clear();
+ if (path.empty()) {
+ normalized = "/";
+ return true;
+ }
+
+ normalized.reserve(path.size() + 1);
+ std::vector<size_t> segment_starts;
+ size_t i = 0;
+
+ while (i < path.size()) {
+ while (i < path.size() && (path[i] == '/' || path[i] == '\\')) {
+ ++i;
+ }
+ if (i >= path.size()) {
+ break;
+ }
+
+ size_t seg_start = normalized.size();
+ normalized.push_back('/');
+
+ while (i < path.size() && path[i] != '/' && path[i] != '\\') {
+ if (path[i] == '%') {
Review Comment:
`TSUrlPathGet()` preserves backslashes as ordinary characters in the URL
path (the URL parser only strips leading `/` characters), but this
normalization treats every raw `\` as a segment separator. As a result, a
request such as `/reports\private` is normalized to `/reports/private` and is
accepted by a `/reports` scope even though it is not a descendant path under
URL segment semantics. Reject raw backslashes (as the existing
encoded-backslash check does) or otherwise keep them within the segment, and
add a regression case for this bypass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
