shreemaan-abhishek opened a new pull request, #14035: URL: https://github.com/apache/apisix/pull/14035
### Description Routes are matched on the normalized `$uri`: Nginx percent-decodes the path, resolves dot segments (including encoded ones such as `..%2F` and `%2e%2e`) and merges consecutive slashes. With `$upstream_uri` left empty, `proxy_pass` then forwards the original request line. When normalization changed the path, the upstream receives a different path from the one the route was matched on. For example, `/admin/..%2Fapi/x` matches a route for `/api/*`, but the upstream receives `/admin/..%2Fapi/x`. This PR forwards the path the route was matched on whenever Nginx did more than percent-decode it: - In `http_access_phase`, if a plain percent-decode of the raw request path differs from `$uri`, `$upstream_uri` is set to the re-encoded `$uri` plus the original query string. This reuses the same equivalence check as `match_uri_encoded_slash`. - Requests that only need percent-decoding still forward the original request line unchanged, so `%2F` inside path parameters and other encodings are preserved. - Plugins that set `$upstream_uri` later (such as `proxy-rewrite`) still take precedence. - `normalize_uri_like_servlet` is left as is, since it already forwards the normalized path. #### Behavior change Upstreams that received raw dot segments or consecutive slashes in the request path (`/a/../b`, `/a/%2e%2e/b`, `/a//b`) now receive the normalized path (`/b`, `/a/b`). Requests without these are unaffected. #### Which issue(s) this PR fixes: Fixes # ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change - [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
