Skip to content

nginx: send Java the path as sent, so an encoded ';' stays one - #572

Merged
adamjohnwright merged 5 commits into
mainfrom
fix/nginx-encoded-semicolon
Oct 20, 2026
Merged

adamjohnwright merged 5 commits into
mainfrom
fix/nginx-encoded-semicolon

Conversation

@adamjohnwright

@adamjohnwright adamjohnwright commented Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Spec 006 (specs/006-content-service-to-node, the matrix-parameter decision of #526). From the review of everything merged since #485.

The problem. The /ContentService/ location's proxy_pass had a URI part, so nginx sent Tomcat its own decoded copy of the path. An encoded ; (%3B) arrived as a raw ;, which Tomcat dropped as a matrix parameter. So /ContentService/data/query%3Bx/R-HSA-109581 and /ContentService/data/database/version%3B, which match no node location, were answered by Java as node's /data/query/{id} and /data/database/version. That is a node route answered by Java, which the port rules out, and it undid #526's refusal of matrix parameters.

The fix. Without a URI part, Tomcat gets the path as sent, as the exporter location already does. /AnalysisService/ gets the same treatment (second commit). A spec in routes.spec.ts holds both locations to it; it was shown failing on each old line.

Checks

  • deploy/nginx specs: 948 passed.
  • nginx -t passes for dev, release and production.
  • Beta's nginx was rebuilt and 13 URLs compared before and after:
    • The two above, and an encoded ; inside an id, are now Java's 404s for the path as sent. Before, they were Java's answers for node's routes.
    • Ten others answer as before: Java's and node's routes, //, ./, an encoded / (the same status and body, though Tomcat is now sent it encoded), the trailing-slash 301, and a diagram export.
    • AnalysisService GETs (database version and name, an unknown token, an escaped letter, a trailing slash) answer as before, timestamps aside.

🤖 Generated with Claude Code

adamjohnwright and others added 5 commits October 20, 2026 18:28
The /ContentService/ location's proxy_pass had a URI part, so nginx sent
Tomcat its decoded copy of the path: %3B arrived as ';', which Tomcat
dropped as a matrix parameter. /data/query%3Bx/R-HSA-109581 and
/data/database/version%3B -- no node location's -- were answered by Java
as node's /data/query/{id} and /data/database/version: a node route
answered by Java, which the port rules out, and the refusal of matrix
parameters (#526) undone by encoding the ';'.

Without a URI part Tomcat gets the path as sent, as the exporter location
already does. A spec holds the location to it (shown failing on the old
config). On beta, before and after: those two and an encoded ';' in an id
are now Java's 404s for the path as sent; ten other URLs (Java's and
node's, '//', './', an encoded '/', an export) unchanged. nginx -t ok for
dev, release and production.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The same rule as /ContentService/: no URI part on its proxy_pass, so the
service is sent the request's path as it was sent, never nginx's decoded
copy. The spec holds both locations to it (shown failing on the
AnalysisService's old line). nginx -t ok for dev, release and production.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@adamjohnwright
adamjohnwright merged commit ea78b65 into main Oct 20, 2026
7 checks passed
@adamjohnwright
adamjohnwright deleted the fix/nginx-encoded-semicolon branch October 20, 2026 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant