Merge pull request #4513 from gofiber/fix-empty-query-url-semantics-issue

🐛 bug: preserve proxy empty-query URL semantics

Author: ReneWerner87

ctx_interface_gen.go

@@ -9,8 +9,6 @@ import (
 )
 
 // Config defines the config for middleware.
-//
-//nolint:govet // struct layout favors readability/grouping over field alignment
 type Config struct {
 	// Next defines a function to skip this middleware when returned true.
 	//
@@ -35,6 +33,13 @@ type Config struct {
 	// and DialDualStack will not be used if the client are set.
 	Client *fasthttp.LBClient
 
+	// SecurityPolicy overrides the default SSRF, redirect, and
+	// hop-by-hop header rules for this balancer. When nil, the
+	// package-level policy set via WithSecurityPolicy is used.
+	//
+	// Optional. Default: nil
+	SecurityPolicy *SecurityPolicy
+
 	// Servers defines a list of <scheme>://<host> HTTP servers,
 	//
 	// which are used in a round-robin manner.
@@ -62,6 +67,14 @@ type Config struct {
 	// Per-connection buffer size for responses' writing.
 	WriteBufferSize int
 
+	// MaxResponseBodySize bounds the size (in bytes) of upstream
+	// responses accepted by the proxy. Responses larger than this are
+	// rejected to protect the proxy from memory exhaustion. Zero
+	// preserves fasthttp's default unlimited behavior.
+	//
+	// Optional. Default: 0
+	MaxResponseBodySize int
+
 	// KeepConnectionHeader keeps the "Connection" header when set to true.
 	//
 	// Note: even when KeepConnectionHeader is true, other RFC 7230 §6.1
@@ -80,21 +93,6 @@ type Config struct {
 	//
 	// Optional. Default: false
 	DialDualStack bool
-
-	// SecurityPolicy overrides the default SSRF, redirect, and
-	// hop-by-hop header rules for this balancer. When nil, the
-	// package-level policy set via WithSecurityPolicy is used.
-	//
-	// Optional. Default: nil
-	SecurityPolicy *SecurityPolicy
-
-	// MaxResponseBodySize bounds the size (in bytes) of upstream
-	// responses accepted by the proxy. Responses larger than this are
-	// rejected to protect the proxy from memory exhaustion. Zero
-	// preserves fasthttp's default unlimited behavior.
-	//
-	// Optional. Default: 0
-	MaxResponseBodySize int
 }
 
 const defaultMaxConnsPerHost = 1024

middleware/proxy/config.go

@@ -605,6 +605,7 @@ func baseIsPlainOrigin(base *url.URL) bool {
 		base.RawPath == "" &&
 		base.User == nil &&
 		base.RawQuery == "" &&
+		!base.ForceQuery &&
 		base.Fragment == "" &&
 		base.Opaque == ""
 }
@@ -647,6 +648,11 @@ func canFastJoinPath(requestPath string) bool {
 				// Repeated path/query separator — let slow path handle.
 				return false
 			}
+			if i == len(requestPath)-1 {
+				// Empty query/fragment markers are not represented in the
+				// slow path's output, so fall back to preserve behavior.
+				return false
+			}
 			inPath = false
 		case '%':
 			if i+2 >= len(requestPath) || !isHexDigit(requestPath[i+1]) || !isHexDigit(requestPath[i+2]) {

middleware/proxy/security.go

@@ -462,6 +462,20 @@ func Test_Security_JoinUpstreamPath_PreservesQuery(t *testing.T) {
 	require.Equal(t, "http://upstream.example/x?y=1&z=2", out)
 }
 
+func Test_Security_JoinUpstreamPath_EmptyQueryMarkersUseSlowPath(t *testing.T) {
+	t.Parallel()
+
+	baseWithEmptyQuery, err := parseUpstream("http://upstream.example?")
+	require.NoError(t, err)
+	require.True(t, baseWithEmptyQuery.ForceQuery)
+	require.Equal(t, "http://upstream.example/foo?", joinUpstreamPath(baseWithEmptyQuery, "/foo"))
+
+	base, err := parseUpstream("http://upstream.example")
+	require.NoError(t, err)
+	require.Equal(t, "http://upstream.example/foo", joinUpstreamPath(base, "/foo?"))
+	require.Equal(t, "http://upstream.example/foo", joinUpstreamPath(base, "/foo#"))
+}
+
 func Test_Security_SecureTLSConfig_DefaultMinVersion(t *testing.T) {
 	t.Parallel()
 	out := secureTLSConfig(nil)