Trailing slash leads to 404 (regression?)

[fnetX]

Gitea Version

3a77465

Git Version

2.30.2 (not relevant?)

Operating System

Debian GNU/Linux 11

How are you running Gitea?

local development via make

Database

SQLite

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Description

Release 1.15.8 might contain a regression. At Codeberg.org we were made aware by users that a trailing slash in the URL leads to a simple "404 page not found" now, breaking some links on the site. If this route is no longer to be used, a forward would be a good option instead.

I made a bisect:

3a77465e4ed252f5d92da12321613328b30b941c is the first bad commit
commit 3a77465e4ed252f5d92da12321613328b30b941c
Author: zeripath <art27@cantab.net>
Date:   Thu Dec 16 23:03:20 2021 +0000

    Prevent double decoding of % in url params  (#17997) (#18001)

So 3a77465 (#17997) (#18001) are relevant.

Screenshots

No response

[zeripath]

What is an example of a link that was valid and is now not valid.

[fnetX]

https://codeberg.org/Codeberg/gitea/ for example.

[6543]

we should add a testcase to https://github.com/go-gitea/gitea/blob/main/integrations/links_test.go#L20 too ...

[fnetX]

#17997 was marked as breaking, but as far as I understand this issue here is a side-effect and the breaking part was only relevant to the handling of % signs? If this behaviour is desired, it was just forgotten to mention this as breaking in the 1.15.8 changelog?

Anyway, I actually encountered this bug myself earlier today, too, by visiting some proposal out of my browser history. It must have gotten there somehow, so I'm wondering if Gitea internally links to the URL with the trailing slash somewhere, too?

[zeripath]

no it wasn't intentional.

Probably simplest if the 404 handler just redirects back to "/foo" from "/foo/" I guess.

[zeripath]

However, this is interesting because the NotFound is coming from src/net/http/server.go:NotFound()

Which is surprising as it should be using the NotFound handler in the mux so things are slightly more interesting ...

[zeripath]

It looks like the NotFound handler has gone missing too.

[mxmehl]

As an intermediate fix for nginx users, here's what we did in the server block:

    # fix for https://github.com/go-gitea/gitea/issues/18060
    proxy_intercept_errors on;
    error_page 404 = @catch404;
    location @catch404 {
        rewrite ^/(.*)/$ /$1;
    }

In case of a 404 error, it just rewrites the URL to remove the slash internally. Could have some sick side-effects and never-ending redirects, but so far it works.

Our nginx config: https://git.fsfe.org/fsfe-system-hackers/git-server/src/branch/master/templates/nginx-site.conf.j2