fix: normalize path before rate-limit bucket keying#27273
Merged
Conversation
The rate limiter keyed buckets on the raw, un-normalized request path (httprate.KeyByEndpoint reads r.URL.Path directly). Coder's existing singleSlashMW collapses redundant slashes for chi's routing but leaves r.URL.Path untouched, so a request like /api/v2/users//validate-password reached the same handler as the canonical path while landing in a different rate-limit bucket, letting a client bypass the limit by respelling the URL. keyByNormalizedEndpoint replaces KeyByEndpoint and runs path.Clean on r.URL.Path before using it as the key. Fixes CDM-02-003 (Cure53). Refs PLAT-376, SEC-265.
Adds TestRateLimitPathNormalization, a regression test for CDM-02-003 (Cure53) that exercises the real coderd router rather than an isolated key function. It exhausts the rate limit against /api/v2/users/validate-password, then confirms redundant-slash variants of the same path share the exhausted bucket instead of getting a fresh one, complementing the existing httpmw-level unit test.
BobbyHo
marked this pull request as ready for review
July 15, 2026 18:26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Coder's rate limiter keyed its bucket on the raw, un-normalized request path (
httprate.KeyByEndpointreadsr.URL.Pathdirectly). The router'ssingleSlashMWalready collapses redundant slashes so a request like/api/v2/users//validate-passwordreaches the same handler as the canonical path, but it never touchedr.URL.Path, so the rate limiter saw a different key and let a client bypass a limit it had already hit just by respelling the URL.keyByNormalizedEndpointreplacesKeyByEndpointand runspath.Cleanonr.URL.Pathbefore using it as the key, so equivalent paths share one bucket. Includes a unit test at the key-function level and an integration test (TestRateLimitPathNormalization) that reproduces the bypass against a real server.Fixes CDM-02-003 (Cure53). Refs https://github.com/coder/security-disclosures/issues/166.