[oleksandr-nc]

HaRP checks a user's request against the ExApp's routes on the raw path, but ExApps read the path decoded: a route for /files/Café.pdf never matches /files/Caf%C3%A9.pdf, and /api/%61dmin/x, /api/admin%2Fx or //api/admin/x are checked against a different route than the one whose handler serves them. Servers also differ on letter case, trailing slashes, ; parameters, backslashes and stray %, and the /heartbeat, /init and /enabled endpoints were refused only in their exact spelling.

HaRP now decides routes on the path decoded once and with // merged. Other readings of the path that some servers use (another letter case, without a trailing slash, without ; parameters, %2F kept inside its segment, // not merged), and the path as a wrapper ExApp passes it on to another server (cut at an escaped ? or #, without ; parameters), can only raise the access level. The forwarded path is one that every server reads the same way: escaped letters, digits and -._~ are decoded, // is merged, a raw \ becomes %5C and a % that starts no escape becomes %25; a path that would be longer than 14 KiB once forwarded is refused, so the agent's reply always fits one SPOE frame. Requests signed by AppAPI keep their path and skip the route check as before. Nothing changes in haproxy.cfg, spoe-agent.conf or the environment, and the image works with every AppAPI version from stable32 to main.

Changes

• Route check on the path decoded once and with // merged; other readings of the path, including the path a wrapper ExApp passes on, can only raise the access level.
• Forwarded path: escaped letters, digits and -._~ decoded, // merged, a raw \ as %5C, a % that starts no escape as %25; a path longer than 14 KiB once forwarded is refused.
• . and .. segments refused in every spelling; control characters and the lifecycle endpoints in any spelling refused unless AppAPI sends the request.
• README: how to write route URLs, and how HaRP reads and forwards the path.
• Unit tests for the readings, the forwarded path and the refused forms.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 115595ca-3849-4a17-b826-be2555f1b170

Commits

Reviewing files that changed from the base of the PR and between 4679856 and 59daba2.

Files selected for processing: 3

• README.md
• haproxy_agent.py
• tests/unit/test_route_paths.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The agent now normalizes ExApp request paths and checks multiple decoded readings when selecting routes. If another matching route requires higher access, route selection applies that access level. The agent rejects specified dot-segment, oversized, control-character, and lifecycle-endpoint paths for non-AppAPI requests. It also sets the forwarded target path in the AppAPI and routed ExApp branches. The README and unit tests describe and cover these behaviors.

Priority: Normal

Merge Risk: Low · up to 59dab

Confirm that encoded query and fragment delimiters cannot weaken route checks or reach lifecycle endpoints before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surv…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description check		The description directly explains the route-matching, path-normalization, forwarding, rejection, documentation, and testing changes.
Title check		The title clearly and concisely describes the main change: route decisions now use the path as ExApps read it.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 24 functions across 2 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0ab377fc-827d-4575-9eb2-1cf62f19e23b

Commits

Reviewing files that changed from the base of the PR and between e32bc9a and 4679856.

Files selected for processing: 3

• README.md
• haproxy_agent.py
• tests/unit/test_route_paths.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.