From 0edfb003701957be51584c45070e285e7d00792f Mon Sep 17 00:00:00 2001
From: Furkan Senharputlu <furkan_senharputlu@hotmail.com>
Date: Sat, 9 Mar 2019 14:35:42 +0300
Subject: [PATCH] Fix URLs in virtual endpoint, js-plugin and coprocess (#2138)

This PR fixes #2112
---
 coprocess.go           |  5 +++--
 mw_js_plugin.go        |  7 +++++--
 mw_js_plugin_test.go   | 29 +++++++++++++++++++++++++++++
 mw_virtual_endpoint.go |  2 +-
 4 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/coprocess.go b/coprocess.go
index 5887078cfd4..9790da1724e 100644
--- a/coprocess.go
+++ b/coprocess.go
@@ -5,6 +5,7 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"net/url"
 	"unicode/utf8"
 
 	"github.com/Sirupsen/logrus"
@@ -85,7 +86,7 @@ func (c *CoProcessor) ObjectFromRequest(r *http.Request) *coprocess.Object {
 		Headers:        headers,
 		SetHeaders:     map[string]string{},
 		DeleteHeaders:  []string{},
-		Url:            r.URL.Path,
+		Url:            r.URL.String(),
 		Params:         ProtoMap(r.URL.Query()),
 		AddParams:      map[string]string{},
 		ExtendedParams: ProtoMap(nil),
@@ -168,7 +169,7 @@ func (c *CoProcessor) ObjectPostProcess(object *coprocess.Object, r *http.Reques
 		values.Set(p, v)
 	}
 
-	r.URL.Path = object.Request.Url
+	r.URL, _ = url.ParseRequestURI(object.Request.Url)
 	r.URL.RawQuery = values.Encode()
 }
 
diff --git a/mw_js_plugin.go b/mw_js_plugin.go
index fd5c24f1f0a..a9cbdd4f74d 100644
--- a/mw_js_plugin.go
+++ b/mw_js_plugin.go
@@ -119,7 +119,7 @@ func (d *DynamicMiddleware) ProcessRequest(w http.ResponseWriter, r *http.Reques
 		SetHeaders:     map[string]string{},
 		DeleteHeaders:  []string{},
 		Body:           originalBody,
-		URL:            r.URL.Path,
+		URL:            r.URL.String(),
 		Params:         r.URL.Query(),
 		AddParams:      map[string]string{},
 		ExtendedParams: map[string][]string{},
@@ -207,7 +207,10 @@ func (d *DynamicMiddleware) ProcessRequest(w http.ResponseWriter, r *http.Reques
 		r.Body = ioutil.NopCloser(bytes.NewReader(newRequestData.Request.Body))
 	}
 
-	r.URL.Path = newRequestData.Request.URL
+	r.URL, err = url.ParseRequestURI(newRequestData.Request.URL)
+	if err != nil {
+		return nil, http.StatusOK
+	}
 
 	// Delete and set headers
 	for _, dh := range newRequestData.Request.DeleteHeaders {
diff --git a/mw_js_plugin_test.go b/mw_js_plugin_test.go
index 2b9ed3db5dc..6b0106cca4f 100644
--- a/mw_js_plugin_test.go
+++ b/mw_js_plugin_test.go
@@ -431,6 +431,35 @@ func TestTykMakeHTTPRequest(t *testing.T) {
 
 		ts.Run(t, test.TestCase{Path: "/sample", BodyMatch: "/api/get?param1=dummy", Code: 200})
 	})
+
+	t.Run("Endpoint with skip cleaning", func(t *testing.T) {
+		ts.Close()
+		globalConf := config.Global()
+		globalConf.HttpServerOptions.SkipURLCleaning = true
+		globalConf.HttpServerOptions.OverrideDefaults = true
+		config.SetGlobal(globalConf)
+
+		prevSkipClean := defaultTestConfig.HttpServerOptions.OverrideDefaults &&
+			defaultTestConfig.HttpServerOptions.SkipURLCleaning
+		testServerRouter.SkipClean(true)
+		defer testServerRouter.SkipClean(prevSkipClean)
+
+		ts := newTykTestServer()
+		defer ts.Close()
+		defer resetTestConfig()
+
+		buildAndLoadAPI(func(spec *APISpec) {
+			spec.Proxy.ListenPath = "/sample"
+			spec.ConfigData = map[string]interface{}{
+				"base_url": ts.URL,
+			}
+			spec.CustomMiddlewareBundle = bundle
+		}, func(spec *APISpec) {
+			spec.Proxy.ListenPath = "/api"
+		})
+
+		ts.Run(t, test.TestCase{Path: "/sample/99999-XXXX+%2F%2F+dog+9+fff%C3%A9o+party", BodyMatch: "URI\":\"/sample/99999-XXXX+%2F%2F+dog+9+fff%C3%A9o+party", Code: 200})
+	})
 }
 
 func TestJSVMBase64(t *testing.T) {
diff --git a/mw_virtual_endpoint.go b/mw_virtual_endpoint.go
index 43c9018aaab..a82c5a66522 100644
--- a/mw_virtual_endpoint.go
+++ b/mw_virtual_endpoint.go
@@ -144,7 +144,7 @@ func (d *VirtualEndpoint) ServeHTTPForCache(w http.ResponseWriter, r *http.Reque
 	requestData := RequestObject{
 		Headers: r.Header,
 		Body:    string(originalBody),
-		URL:     r.URL.Path,
+		URL:     r.URL.String(),
 		Scheme:  scheme,
 	}