fix: clean request path before acls (#1055)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

internal/controller/proxy_controller.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"path"
 	"regexp"
 	"strings"
 
@@ -551,6 +552,19 @@ func (controller *ProxyController) getProxyContext(c *gin.Context) (ProxyContext
 		return ProxyContext{}, err
 	}
 
+	// remove any query params from the request path
+	upath, err := url.Parse(ctx.Path)
+
+	if err != nil {
+		return ProxyContext{}, fmt.Errorf("failed to parse request path: %v", err)
+	}
+
+	if upath.Host != "" || !strings.HasPrefix(upath.Path, "/") {
+		return ProxyContext{}, fmt.Errorf("invalid request path")
+	}
+
+	ctx.Path = path.Clean(upath.Path)
+
 	// We don't care if the header is empty, we will just assume it's not a browser
 	userAgent, _ := controller.getHeader(c, "user-agent")
 	isBrowser := BrowserUserAgentRegex.MatchString(userAgent)