From d1a2e22f3962f405cb9905971d00500e7d196f84 Mon Sep 17 00:00:00 2001
From: idawda <idawda@newrelic.com>
Date: Thu, 25 Jul 2024 12:47:35 +0530
Subject: [PATCH] Fix for NR-286896, where incorrect route calculated when
 empty route detected

---
 .../com/newrelic/api/agent/security/Agent.java   | 16 ++++++++++------
 .../api/agent/security/schema/HttpRequest.java   |  2 +-
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/newrelic-security-agent/src/main/java/com/newrelic/api/agent/security/Agent.java b/newrelic-security-agent/src/main/java/com/newrelic/api/agent/security/Agent.java
index da910b3dd..10b224ac4 100644
--- a/newrelic-security-agent/src/main/java/com/newrelic/api/agent/security/Agent.java
+++ b/newrelic-security-agent/src/main/java/com/newrelic/api/agent/security/Agent.java
@@ -317,17 +317,21 @@ public void registerOperation(AbstractOperation operation) {
                 processStackTrace(operation);
 //        boolean blockNeeded = checkIfBlockingNeeded(operation.getApiID());
 //        securityMetaData.getMetaData().setApiBlocked(blockNeeded);
-                HttpRequest request = securityMetaData.getRequest();
-//                if (StringUtils.isEmpty(request.getRoute())){
+
+                // fallback mechanism for route detection
                 Framework frameWork = Framework.UNKNOWN;
-                if(!securityMetaData.getFuzzRequestIdentifier().getK2Request() && StringUtils.isNotBlank(securityMetaData.getMetaData().getFramework())) {
+                if(StringUtils.isNotBlank(securityMetaData.getMetaData().getFramework())) {
                     frameWork = Framework.valueOf(securityMetaData.getMetaData().getFramework());
                 }
+                HttpRequest request = securityMetaData.getRequest();
                 if (!securityMetaData.getFuzzRequestIdentifier().getK2Request() && StringUtils.isEmpty(request.getRoute())){
-                    request.setRoute(getEndpointRoute(StringUtils.substringBefore(request.getUrl(), "?"), frameWork), true);
+                    String route = getEndpointRoute(StringUtils.substringBefore(request.getUrl(), "?"), frameWork);
+                    if( route != null){
+                        request.setRoute(route);
+                    }
                     logger.log(LogLevel.FINEST,"Route detection using Application Endpoint", this.getClass().getName());
                 }
-//                }
+
                 if (needToGenerateEvent(operation.getApiID())) {
                     DispatcherPool.getInstance().dispatchEvent(operation, securityMetaData);
                     if (!firstEventProcessed.get()) {
@@ -379,7 +383,7 @@ private String getEndpointRoute(String uri) {
                 }
             }
         }
-        return StringUtils.EMPTY;
+        return null;
     }
 
     private int jumpRoute(List<RouteSegment> value, int i1, List<String> uriSegments, int i) {
diff --git a/newrelic-security-api/src/main/java/com/newrelic/api/agent/security/schema/HttpRequest.java b/newrelic-security-api/src/main/java/com/newrelic/api/agent/security/schema/HttpRequest.java
index 5b65ef0f6..1f41add29 100644
--- a/newrelic-security-api/src/main/java/com/newrelic/api/agent/security/schema/HttpRequest.java
+++ b/newrelic-security-api/src/main/java/com/newrelic/api/agent/security/schema/HttpRequest.java
@@ -216,7 +216,7 @@ public String getRoute() {
     }
 
     public void setRoute(String route){
-        this.route = StringUtils.removeEnd(StringUtils.prependIfMissing(route, StringUtils.SEPARATOR), StringUtils.SEPARATOR);
+        this.route = StringUtils.prependIfMissing(StringUtils.removeEnd(route, StringUtils.SEPARATOR), StringUtils.SEPARATOR);
     }
 
     public void setRoute(String segment, boolean isAlreadyServlet) {