BUG/MINOR: fix ReplacePrefixMatch path rewrite edge cases

When ReplacePrefixMatch is "/" and matchPrefix is a non-root prefix (e.g.
"/strip-prefix"), the single replace-path rule produced an empty path for
requests that match the prefix exactly (no suffix), because the optional
capture group \1 evaluates to "".  Two replace-path rules are now emitted:
one anchored to the exact prefix that hard-sets "/" and one for the suffix
case.

When ReplacePrefixMatch is "/" and matchPrefix is also "/", the rewrite is
a no-op for every path.  The set-path rule that was previously emitted used
regsub(^/$,) which stripped the root path to an empty string, causing a 400.
The rule is now skipped entirely.  The same empty-path bug existed in
requestRedirectRules and is fixed there as well.

Author: ivanmatmati

k8s/gate/haproxy/filters/http_filters.go

@@ -278,17 +278,40 @@ func urlRewriteRules(f *gatewayv1.HTTPURLRewriteFilter, matchPrefix string) mode
 			if f.Path.ReplacePrefixMatch != nil && matchPrefix != "" {
 				replacement := strings.TrimRight(*f.Path.ReplacePrefixMatch, "/")
 				if matchPrefix == "/" {
-					rules = append(rules, &models.HTTPRequestRule{
-						Type:    "set-path",
-						PathFmt: fmt.Sprintf("%s%%[path,regsub(^/$,)]", replacement),
-					})
+					// replacement=="" means ReplacePrefixMatch="/" on root match:
+					// every path maps to itself, so no rewrite rule is needed.
+					if replacement != "" {
+						rules = append(rules, &models.HTTPRequestRule{
+							Type:    "set-path",
+							PathFmt: fmt.Sprintf("%s%%[path,regsub(^/$,)]", replacement),
+						})
+					}
 				} else {
 					escapedPrefix := regexEscapePath(matchPrefix)
-					rules = append(rules, &models.HTTPRequestRule{
-						Type:      "replace-path",
-						PathMatch: fmt.Sprintf("^%s(/.*)?$", escapedPrefix),
-						PathFmt:   fmt.Sprintf("%s\\1", replacement),
-					})
+					if replacement == "" {
+						// replacePrefixMatch is "/" (trimmed to ""): two rules are
+						// needed because a single replace-path with \1 produces an
+						// empty path when the request path is exactly the prefix
+						// (no suffix), whereas the expected result is "/".
+						rules = append(rules,
+							&models.HTTPRequestRule{
+								Type:      "replace-path",
+								PathMatch: fmt.Sprintf("^%s$", escapedPrefix),
+								PathFmt:   "/",
+							},
+							&models.HTTPRequestRule{
+								Type:      "replace-path",
+								PathMatch: fmt.Sprintf("^%s(/.*)?$", escapedPrefix),
+								PathFmt:   "\\1",
+							},
+						)
+					} else {
+						rules = append(rules, &models.HTTPRequestRule{
+							Type:      "replace-path",
+							PathMatch: fmt.Sprintf("^%s(/.*)?$", escapedPrefix),
+							PathFmt:   fmt.Sprintf("%s\\1", replacement),
+						})
+					}
 				}
 			}
 		}
@@ -378,6 +401,9 @@ func requestRedirectRules(f *gatewayv1.HTTPRequestRedirectFilter, matchPrefix st
 		}
 		replacement := strings.TrimRight(*f.Path.ReplacePrefixMatch, "/")
 		if matchPrefix == "/" {
+			if replacement == "" {
+				return models.HTTPRequestRules{redirect(pfx+"%[path]", "", "")}
+			}
 			return models.HTTPRequestRules{
 				redirect(fmt.Sprintf("%s%s%%[path,regsub(^/$,)]", pfx, replacement), "", ""),
 			}

k8s/gate/haproxy/filters/http_filters_test.go

@@ -200,6 +200,20 @@ func TestRequestRedirectRules(t *testing.T) {
 			wantType:    "location",
 			wantValue:   "%[path,regsub(^/old,/new)]",
 		},
+		{
+			// replacePrefixMatch "/" with root matchPrefix keeps the path unchanged.
+			name: "replace root prefix with root preserves path",
+			filter: gatewayv1.HTTPRequestRedirectFilter{
+				Path: &gatewayv1.HTTPPathModifier{
+					Type:               gatewayv1.PrefixMatchHTTPPathModifier,
+					ReplacePrefixMatch: new("/"),
+				},
+			},
+			matchPrefix: "/",
+			wantLen:     1,
+			wantType:    "location",
+			wantValue:   "%[path]",
+		},
 		{
 			name: "custom status code",
 			filter: gatewayv1.HTTPRequestRedirectFilter{
@@ -277,12 +291,41 @@ func TestURLRewriteRules(t *testing.T) {
 			wantLen:     1,
 			wantType:    "replace-path",
 		},
+		{
+			// replacePrefixMatch "/" on a non-root prefix needs two rules:
+			// one for the exact prefix (→ "/") and one for prefix+suffix.
+			name: "strip prefix to root",
+			filter: gatewayv1.HTTPURLRewriteFilter{
+				Path: &gatewayv1.HTTPPathModifier{
+					Type:               gatewayv1.PrefixMatchHTTPPathModifier,
+					ReplacePrefixMatch: new("/"),
+				},
+			},
+			matchPrefix: "/strip-prefix",
+			wantLen:     2,
+			wantType:    "replace-path",
+		},
+		{
+			// replacePrefixMatch "/" with root matchPrefix is a no-op: every path
+			// maps to itself, so no rewrite rule should be emitted.
+			name: "replace root prefix with root is no-op",
+			filter: gatewayv1.HTTPURLRewriteFilter{
+				Path: &gatewayv1.HTTPPathModifier{
+					Type:               gatewayv1.PrefixMatchHTTPPathModifier,
+					ReplacePrefixMatch: new("/"),
+				},
+			},
+			matchPrefix: "/",
+			wantLen:     0,
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			rules := urlRewriteRules(&tc.filter, tc.matchPrefix)
 			require.Len(t, rules, tc.wantLen)
-			assert.Equal(t, tc.wantType, rules[0].Type)
+			if len(rules) > 0 {
+				assert.Equal(t, tc.wantType, rules[0].Type)
+			}
 		})
 	}
 }