From fbfb8fc517728f85890cd46559c01bec9495bf17 Mon Sep 17 00:00:00 2001 From: Matthew Holt Date: Wed, 4 Mar 2026 16:18:33 -0700 Subject: [PATCH] rewrite: Force recomputing path when escaped path matches rewrite target Thank you for the report by @MaherAzzouzi, and the suggested fix! --- modules/caddyhttp/rewrite/rewrite.go | 1 + modules/caddyhttp/rewrite/rewrite_test.go | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/modules/caddyhttp/rewrite/rewrite.go b/modules/caddyhttp/rewrite/rewrite.go index 2b18744db..ca5f63bac 100644 --- a/modules/caddyhttp/rewrite/rewrite.go +++ b/modules/caddyhttp/rewrite/rewrite.go @@ -247,6 +247,7 @@ func (rewr Rewrite) Rewrite(r *http.Request, repl *caddy.Replacer) bool { } else { r.URL.Path = path } + r.URL.RawPath = "" // force recomputing when EscapedPath() is called } if qsStart >= 0 { r.URL.RawQuery = newQuery diff --git a/modules/caddyhttp/rewrite/rewrite_test.go b/modules/caddyhttp/rewrite/rewrite_test.go index 81360baee..c3b4c1f6c 100644 --- a/modules/caddyhttp/rewrite/rewrite_test.go +++ b/modules/caddyhttp/rewrite/rewrite_test.go @@ -224,6 +224,11 @@ func TestRewrite(t *testing.T) { input: newRequest(t, "GET", "/foo#fragFirst?c=d"), expect: newRequest(t, "GET", "/bar#fragFirst?c=d"), }, + { + rule: Rewrite{URI: "/api/admin/panel"}, + input: newRequest(t, "GET", "/api/admin%2Fpanel"), + expect: newRequest(t, "GET", "/api/admin/panel"), + }, { rule: Rewrite{StripPathPrefix: "/prefix"},