fix(controller): reject query string or fragment in upstreamDefinitions URLs#2076
fix(controller): reject query string or fragment in upstreamDefinitions URLs#2076mehara-rothila wants to merge 4 commits into
Conversation
|
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughSummaryThis PR adds validation to enforce that Changespkg/config/api_validator.go
pkg/config/validator_test.go
it/features/api_deploy.feature
ImpactUsers deploying APIs with query strings or fragments in WalkthroughThis pull request updates 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.12.2)level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain modules listed in go.work or their selected dependencies" Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
gateway/gateway-controller/pkg/config/validator_test.go (1)
623-643: ⚡ Quick winAdd coverage for the trailing
?case.Line 624 covers a non-empty query, but the validator also rejects
parsedURL.ForceQueryfor URLs likehttp://backend-1:8080?. Please add that case so the full new branch stays protected.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@gateway/gateway-controller/pkg/config/validator_test.go` around lines 623 - 643, TestValidateUpstreamDefinitions_URLWithQueryRejected only covers URLs with a non-empty query; add a second assertion case that passes an upstream URL ending with a trailing '?' (e.g., "http://backend-1:8080?") to exercise the parsedURL.ForceQuery branch. Update the test (within TestValidateUpstreamDefinitions_URLWithQueryRejected or a small companion test) to call validator.validateUpstreamDefinitions with that URL and assert the returned error references "spec.upstreamDefinitions[0].upstreams[0].url" and contains "query string" (or the same message used for ForceQuery), ensuring the validator.validateUpstreamDefinitions/parsedURL.ForceQuery behavior is covered.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@gateway/gateway-controller/pkg/config/validator_test.go`:
- Around line 623-643: TestValidateUpstreamDefinitions_URLWithQueryRejected only
covers URLs with a non-empty query; add a second assertion case that passes an
upstream URL ending with a trailing '?' (e.g., "http://backend-1:8080?") to
exercise the parsedURL.ForceQuery branch. Update the test (within
TestValidateUpstreamDefinitions_URLWithQueryRejected or a small companion test)
to call validator.validateUpstreamDefinitions with that URL and assert the
returned error references "spec.upstreamDefinitions[0].upstreams[0].url" and
contains "query string" (or the same message used for ForceQuery), ensuring the
validator.validateUpstreamDefinitions/parsedURL.ForceQuery behavior is covered.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f311aa0a-4685-4e02-aafa-3e039c750a17
📒 Files selected for processing (2)
gateway/gateway-controller/pkg/config/api_validator.gogateway/gateway-controller/pkg/config/validator_test.go
mehara-rothila
force-pushed
the
fix/upstream-url-query-fragment
branch
from
5d4499b to
227e19b
Compare
mehara-rothila
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Krishanx92,
PasanT9,
RakhithaRR,
Tharsanan1,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub and
tharindu1st
as code owners
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds stricter validation for upstreamDefinitions[].upstreams[].url to reject query strings and fragments (which would otherwise be silently ignored), along with new unit tests covering these cases.
Changes:
- Reject upstream URLs that include a query string (including a bare
?). - Reject upstream URLs that include a fragment (
#...). - Add unit tests for query and fragment rejection.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| gateway/gateway-controller/pkg/config/validator_test.go | Adds tests ensuring upstream URLs with query/fragment are rejected. |
| gateway/gateway-controller/pkg/config/api_validator.go | Adds validation that flags query strings and fragments as invalid in upstream URLs. |
|
@coderabbitai Can you do a final review and tell me if this PR is complete and ready to merge, or if anything is missing? Context , this PR rejects a query string or fragment in
Please confirm:
|
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Read the validator file
fd -e go api_validator.go --exec cat {}
echo "=== SEPARATOR ==="
# Read the test file
fd -e go validator_test.go --exec cat {}
echo "=== SEPARATOR2 ==="
# Read the integration test feature file
fd -e feature api_deploy.feature --exec cat {}Length of output: 176091
1. Validation logic — fully covered?Yes. The three cases are all handled correctly in
One very minor edge case: a bare 2. Error messages — clear and consistent?Yes. The two new messages are clear:
They differ slightly in style from the existing path message ( 3. Integration test — sufficient?Sufficient as-is. The 4. Anything else blocking merge?Nothing blocking. A few minor observations for completeness:
The PR is complete and ready to merge. |
Purpose
upstreamDefinitions[].upstreams[].urlis intended to be host[:port] only — an upstream definition's base path is configured exclusively viaupstreamDefinitions[].basePath(per #2064 and #369 (comment)).A path in such a URL is already rejected with a 400 (#2065), but a query string (
?foo=bar) or fragment (#section) is silently accepted: the upstream cluster is built from host:port only, so the query string and fragment are dropped and never reach the upstream — with no signal to the user that the value was ignored.Fixes #2068.
Related #2064.
Goals
Reject a query string or fragment in an
upstreamDefinitionsURL with a 400 at deploy time, consistent with how an embedded path is already handled — giving the user a clear, unambiguous contract that these URLs are host[:port] only.Approach
pkg/config/api_validator.go: invalidateUpstreamDefinitions, immediately after the existing feat(controller)!: take upstreamDefinitions base path from basePath #2065 path check, reject a URL whoseRawQueryis non-empty or that carries a bare?(ForceQuery) with "URL must not include a query string", and a URL with a non-emptyFragmentwith "URL must not include a fragment".upstreamDefinitionsURLs; the downstream consumers (pkg/transform/restapi.go,pkg/xds/translator.go) run after validation and read only host/scheme, so no change is needed there.upstream.main/upstream.sandboxURLs are unchanged — they legitimately carry a base path in the URL path and are validated separately (validateUpstreamUrl); query/fragment handling for those is outside the scope of this issue.User stories
As an API developer, when I mistakenly put a query string or fragment in an
upstreamDefinitionsURL, I get a clear 400 at deploy time instead of having the value silently dropped at runtime.Documentation
N/A — no new configuration is introduced; this tightens validation of an existing field to match the documented host[:port]-only contract.
Automation tests
Security checks
Samples
N/A
Related PRs
#2065 (take upstreamDefinitions base path from basePath) introduced the path rejection this builds on; #2059 (dynamic-endpoint sandbox routing) is adjacent work on the same area.
Test environment
Go (multi-module workspace);
go test ./pkg/config/.