feat(listener): make normalize_path and path_with_escaped_slashes_act… - #7703
Open
agentdanabol wants to merge 5 commits into
Open
Conversation
agentdanabol
requested review from
sunjayBhatia and
tsaarni
and removed request for
a team
August 28, 2026 11:19
agentdanabol
force-pushed
the
fix/7694-normalize-path-and-path-with-escaped-slashes
branch
2 times, most recently
from
August 28, 2026 11:52
9202469 to
f0a93b4
Compare
…ion configurable Signed-off-by: sheiko <sheiko@tochka.com>
agentdanabol
force-pushed
the
fix/7694-normalize-path-and-path-with-escaped-slashes
branch
from
August 28, 2026 11:55
f0a93b4 to
5a4f8e2
Compare
tsaarni
added
the
release-note/small
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #7703 +/- ##
==========================================
+ Coverage 82.33% 84.04% +1.71%
==========================================
Files 131 131
Lines 15915 14225 -1690
==========================================
- Hits 13103 11956 -1147
+ Misses 2523 2269 -254
+ Partials 289 0 -289
🚀 New features to boost your workflow:
|
agentdanabol
marked this pull request as draft
August 31, 2026 10:55
added 3 commits
August 31, 2026 15:01
Two failures from the previous run:
- unescape_and_redirect expected 301, but Envoy answers escaped-slash
redirects with 307 and a path-only Location header. See the
NormalizePathAction::Redirect handling in Envoy's conn_manager_impl.cc,
which uses Code::TemporaryRedirect.
- disableNormalizePath asserted on which backend answered, which depends
on route matching. Assert on the ":path" the upstream actually receives
instead, using a single catch-all route. This is what normalize_path
documents ("This affects the upstream :path header as well") and removes
route matching from the assertion.
The previous run showed the un-normalized path still being collapsed, so
also log Envoy's own /config_dump normalize_path counts. That makes a
future failure self-diagnosing: it distinguishes "the setting never
reached Envoy" from "Envoy did not honor the setting". Best effort, since
the admin listener is not what this spec asserts.
Signed-off-by: sheiko <sheiko@tochka.com>
The previous assertion could not distinguish the two cases it was meant to
tell apart. The echo fixture is a Go ServeMux server, and ServeMux cleans
the request path itself, answering 301 to the cleaned target. Because the
test client follows redirects, "/foo/../bar" ended up re-requested as
"/bar" either way:
- Envoy normalizes -> backend gets "/bar", 200, path "/bar"
- Envoy does not -> backend gets "/foo/../bar", 301 -> follow
-> re-request "/bar", 200, path "/bar"
Both produced "upstream saw /bar, status 200", which is why the earlier
route-matching variant reported echo-1: the followed request for "/bar"
matched the "/bar" prefix route. Note "/foo%2Fbar" is not cleaned by
ServeMux, which is why the escaped-slashes specs were unaffected.
Stop following redirects and assert on the first response instead, which
makes the backend's behavior the signal: 301 with Location "/bar" proves
Envoy forwarded the dot segments verbatim, 200 proves it normalized them.
Also drop the /config_dump diagnostic: it reported the admin listener as
unreachable from this suite, so it added nothing.
Signed-off-by: sheiko <sheiko@tochka.com>
check-changefile-exists.go requires changelogs/unreleased/PR#-author-category. The file was named after issue 7694 instead of PR 7703, so the Release Note Label Check failed on the missing changelog. The category still matches the release-note/small label on the PR. Signed-off-by: sheiko <sheiko@tochka.com>
agentdanabol
marked this pull request as ready for review
August 31, 2026 17:55
…ath-with-escaped-slashes
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7694 by adding two new listener settings for exposing Envoy path transformations that Contour previously hardcoded