Cache key normalization does not properly distinguish requests

[JustinAzoff]

Is this a BUG report or FEATURE request?:

Bug

What happened:

The default cache key normalizes different requests to the same cache key

What you expected to happen:

Different requests would use different cache keys

How to reproduce it (as minimally and precisely as possible):

global
    maxconn 100
    cache on

defaults
    mode http
    timeout connect 5s
    timeout client 5s
    timeout server 5s

frontend myfrontend
    bind :8888
    default_backend mybackend

backend mybackend
    # a http backend
    http-request set-header Host httpbin.org
    server s httpbin.org:80
    filter cache
    cache-rule all ttl 3600

Then make two requests that differ only in the position of the '?':

$ curl localhost:8888/get?name=hello
{
  "args": {
    "name": "hello"
  },
  "headers": {
    "Accept": "*/*",
    "Connection": "close",
    "Host": "httpbin.org",
    "User-Agent": "curl/7.54.0"
  },
  "origin": "x",
  "url": "http://httpbin.org/get?name=hello"
}

$ curl localhost:8888/?getname=hello
{
  "args": {
    "name": "hello"
  },
  "headers": {
    "Accept": "*/*",
    "Connection": "close",
    "Host": "httpbin.org",
    "User-Agent": "curl/7.54.0"
  },
  "origin": "x",
  "url": "http://httpbin.org/get?name=hello"
}

Anything else we need to know?:

This is similar to what caused this issue: https://rdist.root.org/2009/05/20/amazon-web-services-signature-vulnerability/

[jiangwenyuan]

@JustinAzoff Thanks a lot for pointing out :)