[oleksandr-nc]

The ExApp proxy refuses a path with a .. segment before it looks for a matching route, so that the route is decided on the path the ExApp serves. The check only knew .. followed by /, %2F or the end of the path, and three other forms reached the ExApp as a different path than the one the route was matched against:

• ..; and ..;x=1: Tomcat and other Java servers drop ; path parameters and then resolve ...
• .. followed by %3F or %23: the proxy forwards the path cut at the decoded ? or #, and curl resolves the .. that is now at the end, so a/..%3F/b reaches the ExApp as /.
• . segments, also percent-encoded: curl removes them before it sends the request, so ./admin/x is matched as /./admin/x while the ExApp receives /admin/x.

The proxy now answers 404 for . and .. segments, also percent-encoded, followed by /, ;, %3F, %23, %2F or the end of the path. Browsers resolve dot segments before they send a request, so ExApp pages and their API calls do not contain them; names such as a..b, ..foo, .well-known or file;v=1 are forwarded as before.

Changes

• The dot-segment check of the proxy covers . segments and segments followed by ;, %3F or %23.
• Tests for the paths the proxy refuses and forwards.

[coderabbitai]

Walkthrough

prepareProxy now rejects one- and two-dot path segments, including encoded forms and segments followed by additional delimiters. Tests cover paths that are rejected and paths that are forwarded. The changelog records the change.

Priority: Low

Merge Risk: Moderate · up to a3e3d

Some encoded dot-segment paths can still be forwarded instead of returning 404. Add the missing delimiters and test them before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 2 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the proxy fix for refusing dot segments after route matching.
Description check		The description accurately explains the proxy behavior change, affected path forms, and test coverage.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 PHPStan (2.3.0)

PHPStan reported 1 non-file analysis error(s); analysis is incomplete

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3b34fe0a-1dd0-4cdb-a0ae-4ae38384e295

Commits

Reviewing files that changed from the base of the PR and between 22d5900 and a3e3d7f.

Files selected for processing: 3

• CHANGELOG.md
• lib/Controller/ExAppProxyController.php
• tests/php/Controller/ExAppProxyControllerTest.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.