title: Path traversal in request_uri variable
description: The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.
problem types: Use Nginx's $request_uri variable without verification
affected:
{
product: Apache APISIX
vendor: Apache Software Foundation
versions:
lessThan: Apache APISIX 1.5*, status: affected, version: 1.5, versionType: custom
}
metrics:
other: [
content: {'other': 'moderate'}
type: unknown
]
workarounds: 1. Upgrade to APISIX 2.10.2, or apply this commit which provides a normalized $request_uri: https://github.com/apache/apisix/commit/9fc38330e82ce46e2aaabceef7d61708c91782db
2. Carefully review custom code, find & fix the usage of $request_uri without verification.