Skip to content

Commit 54bbfdf

Browse files
committed
MINOR: Refine route-acl rules to prevent unintended prefix matches
Since `route-acl` annotated rules take precedence over others, this commit updates its behavior to ensure they do not unintentionally overwrite other rules that share the same prefix. For example, a rule matching the path /api should not inadvertently handle requests to /apiary.
1 parent b2141fa commit 54bbfdf

File tree

2 files changed

+7
-1
lines changed

2 files changed

+7
-1
lines changed

.aspell.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
mode: commit
22
min_length: 3
33
allowed:
4+
- acl
45
- aspell
56
- repo
67
- yaml

pkg/route/route.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,12 @@ func AddCustomRoute(route Route, routeACLAnn string, api api.HAProxyClient) (err
109109
if route.Path.PathTypeMatch == store.PATH_TYPE_EXACT {
110110
routeCond = fmt.Sprintf("%s{ path %s }", routeCond, route.Path.Path)
111111
} else {
112-
routeCond = fmt.Sprintf("%s{ path -m beg %s }", routeCond, route.Path.Path)
112+
if route.Path.Path == "/" {
113+
routeCond = fmt.Sprintf("%s{ path -m beg %s }", routeCond, route.Path.Path)
114+
} else {
115+
path := strings.TrimSuffix(route.Path.Path, "/")
116+
routeCond = fmt.Sprintf("%s{ path -m reg ^%s($|/) }", routeCond, path)
117+
}
113118
}
114119
}
115120
routeCond = fmt.Sprintf("%s { %s } ", routeCond, routeACLAnn)

0 commit comments

Comments
 (0)