Le 09/09/2026 à 10:31 AM, Youngkwang Lee a écrit :
Hi,these two patches fix GitHub issue #3493, which Christopher confirmed. The normalizers that take an optional sub-option only set rule->action in the branch handling that sub-option and in the branch handling the end of the arguments. When the sub-option is left out and an "if" or "unless" follows the normalizer name directly, neither branch is taken and rule->action keeps its initial value, which happens to be ACT_NORMALIZE_URI_PATH_MERGE_SLASHES. So this configuration: http-request normalize-uri percent-decode-unreserved if { ... } merges duplicate slashes instead of decoding percent sequences. percent-to-uppercase and path-strip-dotdot are affected the same way; spelling out "strict" or "full" avoids it. The first patch sets the default action right after the normalizer name is matched and lets the sub-option overwrite it, keeping the check that rejects unknown arguments. The second one adds a reg-test: the request carries both a percent sequence and duplicate slashes so that the two candidate normalizers produce different results. With the first patch reverted it fails on the value, not on a missing header. The three affected normalizers all landed in 2.4-dev, so this looks backportable to all stable versions. Best regards Youngkwang Lee (2): BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition REGTESTS: uri_normalizer: test a normalizer used with a condition reg-tests/http-rules/normalize_uri.vtc | 27 ++++++++++++++++++++++++++ src/http_act.c | 24 +++++++++++------------ 2 files changed, 39 insertions(+), 12 deletions(-)
Thanks, both patches were merged ! -- Christopher Faulet
