Merge pull request Kong#431 from johnmuth/master

Fix for stripping paths containing magic characters.

Former-commit-id: 93b56c227b3d8ad8acfa3494867693cf67e59f6a

kong/resolver/access.lua

@@ -166,7 +166,8 @@ function _M.execute(conf)
   if by_path and api.strip_path then
     -- Replace `/path` with `path`, and then prefix with a `/`
     -- Or replace `/path/foo` with `/foo`, and then do not prefix with `/`.
-    request_uri = string.gsub(request_uri, api.path, "")
+    local escaped_path = api.path:gsub("[%(%)%.%%%+%-%*%?%[%]%^%$]", function(c) return "%" .. c end)
+    request_uri = string.gsub(request_uri, escaped_path, "")
     if string.sub(request_uri, 0, 1) ~= "/" then
       request_uri = "/"..request_uri
     end

spec/integration/proxy/api_resolver_spec.lua

@@ -29,6 +29,7 @@ describe("Resolver", function()
         {name = "tests host resolver 2", public_dns = "mockbin-auth.com", target_url = "http://mockbin.com"},
         {name = "tests path resolver", target_url = "http://mockbin.com", path = "/status/"},
         {name = "tests stripped path resolver", target_url = "http://mockbin.com", path = "/mockbin/", strip_path = true},
+        {name = "tests stripped path resolver with magic", target_url = "http://mockbin.com", path = "/mockbin-with-magic/", strip_path = true},
         {name = "tests deep path resolver", target_url = "http://mockbin.com", path = "/deep/path/", strip_path = true},
         {name = "tests wildcard subdomain", target_url = "http://mockbin.com/status/200", public_dns = "*.wildcard.com"},
         {name = "tests wildcard subdomain 2", target_url = "http://mockbin.com/status/201", public_dns = "wildcard.*"}
@@ -162,6 +163,13 @@ describe("Resolver", function()
         assert.equal("http://mockbin.com/request", body.url)
       end)
 
+      it("should proxy and strip the path if `strip_path` is true if path has magic characters", function()
+        local response, status = http_client.get(spec_helper.PROXY_URL.."/mockbin-with-magic/request")
+        assert.equal(200, status)
+        local body = cjson.decode(response)
+        assert.equal("http://mockbin.com/request", body.url)
+      end)
+
       it("should proxy when the path has a deep level", function()
         local _, status = http_client.get(spec_helper.PROXY_URL.."/deep/path/status/200")
         assert.equal(200, status)