Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/requests/util/util.go

@@ -47,16 +47,28 @@ func GetRequestURI(req *http.Request) string {
 
 // GetRequestPath returns the request URI or X-Forwarded-Uri if present and the
 // request came from a trusted reverse proxy but always strips the query
-// parameters and only returns the pure path.
+// parameters and fragment suffixes and only returns the pure path.
 func GetRequestPath(req *http.Request) string {
-	uri := GetRequestURI(req)
+	uri := stripRequestFragment(GetRequestURI(req))
 
 	// Parse URI and return only the path component
 	if parsedURL, err := url.Parse(uri); err == nil {
-		return parsedURL.Path
+		return stripRequestFragment(parsedURL.Path)
 	}
 
 	// Fallback: strip query parameters manually
+	return stripRequestQuery(uri)
+}
+
+func stripRequestFragment(uri string) string {
+	if idx := strings.Index(uri, "#"); idx != -1 {
+		return uri[:idx]
+	}
+
+	return uri
+}
+
+func stripRequestQuery(uri string) string {
 	if idx := strings.Index(uri, "?"); idx != -1 {
 		return uri[:idx]
 	}

pkg/requests/util/util_test.go

@@ -152,6 +152,23 @@ var _ = Describe("Util Suite", func() {
 				Expect(util.GetRequestPath(req)).To(Equal(uriNoQueryParams))
 			})
 
+			It("drops fragment content from a parsed request path", func() {
+				// Simulate net/http ParseRequestURI preserving '#' in URL.Path.
+				req.URL.Path = "/foo/secret#/bar"
+				req.URL.RawPath = "/foo/secret%23/bar"
+				Expect(util.GetRequestPath(req)).To(Equal("/foo/secret"))
+			})
+
+			It("drops fragment-like suffixes from encoded number signs", func() {
+				req = httptest.NewRequest(
+					http.MethodGet,
+					fmt.Sprintf("%s://%s/foo/secret%%23/bar?query=param", proto, host),
+					nil,
+				)
+				req = middleware.AddRequestScope(req, &middleware.RequestScope{})
+				Expect(util.GetRequestPath(req)).To(Equal("/foo/secret"))
+			})
+
 			It("ignores X-Forwarded-Uri and returns the URI (without query params)", func() {
 				req.Header.Add("X-Forwarded-Uri", "/some/other/path?query=param")
 				Expect(util.GetRequestPath(req)).To(Equal(uriNoQueryParams))
@@ -175,6 +192,11 @@ var _ = Describe("Util Suite", func() {
 				req.Header.Add("X-Forwarded-Uri", "/some/other/path?query=param")
 				Expect(util.GetRequestPath(req)).To(Equal("/some/other/path"))
 			})
+
+			It("drops fragment-like suffixes from the X-Forwarded-Uri", func() {
+				req.Header.Add("X-Forwarded-Uri", "/foo/secret%23/bar?query=param")
+				Expect(util.GetRequestPath(req)).To(Equal("/foo/secret"))
+			})
 		})
 	})