Make encoded character options opt-in

pkg/server/router/deny.go

@@ -2,29 +2,10 @@ package router
 
 import (
 	"net/http"
-	"strings"
 
 	"github.com/traefik/traefik/v2/pkg/log"
 )
 
-// denyFragment rejects the request if the URL path contains a fragment (hash character).
-// When go receives an HTTP request, it assumes the absence of fragment URL.
-// However, it is still possible to send a fragment in the request.
-// In this case, Traefik will encode the '#' character, altering the request's intended meaning.
-// To avoid this behavior, the following function rejects requests that include a fragment in the URL.
-func denyFragment(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		if strings.Contains(req.URL.RawPath, "#") {
-			log.WithoutContext().Debugf("Rejecting request because it contains a fragment in the URL path: %s", req.URL.RawPath)
-			rw.WriteHeader(http.StatusBadRequest)
-
-			return
-		}
-
-		h.ServeHTTP(rw, req)
-	})
-}
-
 // denyEncodedPathCharacters reject the request if the escaped path contains encoded characters in the given list.
 func denyEncodedPathCharacters(encodedCharacters map[string]struct{}, h http.Handler) http.Handler {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {

pkg/server/router/deny_test.go

@@ -8,42 +8,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-func Test_denyFragment(t *testing.T) {
-	tests := []struct {
-		name       string
-		url        string
-		wantStatus int
-	}{
-		{
-			name:       "Rejects fragment character",
-			url:        "http://example.com/#",
-			wantStatus: http.StatusBadRequest,
-		},
-		{
-			name:       "Allows without fragment",
-			url:        "http://example.com/",
-			wantStatus: http.StatusOK,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			t.Parallel()
-
-			handler := denyFragment(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.WriteHeader(http.StatusOK)
-			}))
-
-			req := httptest.NewRequest(http.MethodGet, test.url, nil)
-			res := httptest.NewRecorder()
-
-			handler.ServeHTTP(res, req)
-
-			assert.Equal(t, test.wantStatus, res.Code)
-		})
-	}
-}
-
 func Test_denyEncodedPathCharacters(t *testing.T) {
 	tests := []struct {
 		name       string

pkg/server/router/router.go

@@ -223,14 +223,11 @@ func (m *Manager) buildHTTPHandler(ctx context.Context, router *runtime.RouterIn
 		chain = chain.Append(denyrouterrecursion.WrapHandler(routerName))
 	}
 
-	// Here we are adding deny handlers for encoded path characters and fragment.
-	// Deny handler are only added for root routers, child routers are protected by their parent router deny handlers.
-	chain = chain.Append(func(next http.Handler) (http.Handler, error) {
-		return denyFragment(next), nil
-	})
-	chain = chain.Append(func(next http.Handler) (http.Handler, error) {
-		return denyEncodedPathCharacters(router.DeniedEncodedPathCharacters.Map(), next), nil
-	})
+	if router.DeniedEncodedPathCharacters != nil {
+		chain = chain.Append(func(next http.Handler) (http.Handler, error) {
+			return denyEncodedPathCharacters(router.DeniedEncodedPathCharacters.Map(), next), nil
+		})
+	}
 
 	return chain.Extend(*mHandler).Append(tHandler).Then(sHandler)
 }

pkg/server/router/router_test.go

@@ -910,13 +910,16 @@ func TestManager_BuildHandlers_Deny(t *testing.T) {
 		expectedStatusCode int
 	}{
 		{
-			desc:        "unallowed request with encoded slash",
+			desc:        "disallow request with encoded slash",
 			requestPath: "/foo%2F",
 			routers: map[string]*dynamic.Router{
 				"parent": {
 					EntryPoints: []string{"web"},
 					Rule:        "PathPrefix(`/`)",
 					Service:     "service",
+					DeniedEncodedPathCharacters: &dynamic.RouterDeniedEncodedPathCharacters{
+						AllowEncodedSlash: false,
+					},
 				},
 			},
 			services: map[string]*dynamic.Service{
@@ -936,9 +939,6 @@ func TestManager_BuildHandlers_Deny(t *testing.T) {
 					EntryPoints: []string{"web"},
 					Rule:        "PathPrefix(`/`)",
 					Service:     "service",
-					DeniedEncodedPathCharacters: dynamic.RouterDeniedEncodedPathCharacters{
-						AllowEncodedSlash: true,
-					},
 				},
 			},
 			services: map[string]*dynamic.Service{
@@ -950,25 +950,6 @@ func TestManager_BuildHandlers_Deny(t *testing.T) {
 			},
 			expectedStatusCode: http.StatusBadGateway,
 		},
-		{
-			desc:        "unallowed request with fragment",
-			requestPath: "/foo#",
-			routers: map[string]*dynamic.Router{
-				"parent": {
-					EntryPoints: []string{"web"},
-					Rule:        "PathPrefix(`/`)",
-					Service:     "service",
-				},
-			},
-			services: map[string]*dynamic.Service{
-				"service": {
-					LoadBalancer: &dynamic.ServersLoadBalancer{
-						Servers: []dynamic.Server{{URL: "http://localhost:8080"}},
-					},
-				},
-			},
-			expectedStatusCode: http.StatusBadRequest,
-		},
 	}
 
 	for _, test := range testCases {