Merge remote-tracking branch 'origin/main' into codex/issue-8487-license-spdx-compliance

Signed-off-by: Jonah Kowall <jkowall@kowall.net>

# Conflicts:
#	examples/reverse-proxy/docker-compose.yml

Author: jkowall

.github/workflows/ci-e2e-all.yml

@@ -45,3 +45,6 @@ jobs:
 
   tailsampling:
     uses: ./.github/workflows/ci-e2e-tailsampling.yml
+
+  ui-reverse-proxy:
+    uses: ./.github/workflows/ci-e2e-ui-reverse-proxy.yml

.github/workflows/ci-e2e-ui-reverse-proxy.yml

@@ -0,0 +1,48 @@
+# Copyright (c) 2026 The Jaeger Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+# E2E integration tests for Jaeger UI served behind a reverse proxy (ADR-009).
+# Validates three use cases in a single job:
+#
+#   UC-1: proxy forwards the URL prefix unchanged to Jaeger
+#         (exercises the existing examples/reverse-proxy/ setup)
+#   UC-2: single Jaeger pod served under two different external prefixes
+#         simultaneously, with the proxy stripping the prefix on one path
+#   UC-3: proxy rewrites an external prefix to a different internal prefix
+#         (the case that motivated ADR-009 / issue #5157)
+
+name: CIT UI Reverse Proxy
+
+on:
+  workflow_call:
+
+# See https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
+permissions:
+  contents: read
+
+jobs:
+  ui-reverse-proxy:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+      with:
+        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      with:
+        submodules: true
+
+    - name: Fetch git tags
+      run: git fetch --prune --unshallow --tags
+
+    - uses: ./.github/actions/setup-go
+      with:
+        go-version: 1.26.x
+
+    - name: Setup Node.js version
+      uses: ./.github/actions/setup-node.js
+
+    - name: Run UI reverse-proxy integration tests (UC-1, UC-2, UC-3)
+      run: bash scripts/e2e/ui-reverse-proxy.sh

cmd/jaeger/internal/extension/jaegerquery/config.go

@@ -4,6 +4,10 @@
 package jaegerquery
 
 import (
+	"fmt"
+	"path"
+	"strings"
+
 	"github.com/asaskevich/govalidator"
 	"go.opentelemetry.io/collector/confmap/xconfmap"
 
@@ -29,6 +33,23 @@ type Storage struct {
 }
 
 func (cfg *Config) Validate() error {
+	// Normalize BasePath once so all downstream consumers see a clean value.
+	bp := cfg.BasePath
+	if bp != "" && bp != "/" {
+		if !strings.HasPrefix(bp, "/") {
+			return fmt.Errorf("invalid base_path %q: must start with '/'", bp)
+		}
+		// path.Clean collapses duplicate slashes and resolves . / .. segments,
+		// producing a canonical path without a trailing slash.
+		clean := path.Clean(bp)
+		if clean != bp && clean+"/" != bp {
+			// The value had duplicate slashes or traversal segments beyond a
+			// single trailing slash — reject it so callers don't silently get
+			// a different path than they intended.
+			return fmt.Errorf("invalid base_path %q: must not contain dot segments, path traversal, or duplicate slashes (normalized: %q)", bp, clean)
+		}
+		cfg.BasePath = clean
+	}
 	_, err := govalidator.ValidateStruct(cfg)
 	return err
 }

cmd/jaeger/internal/extension/jaegerquery/config_test.go

@@ -8,13 +8,16 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+
+	queryapp "github.com/jaegertracing/jaeger/cmd/jaeger/internal/extension/jaegerquery/internal"
 )
 
 func Test_Validate(t *testing.T) {
 	tests := []struct {
-		name        string
-		config      *Config
-		expectedErr string
+		name             string
+		config           *Config
+		expectedErr      string
+		expectedBasePath string
 	}{
 		{
 			name:        "Empty config",
@@ -30,15 +33,59 @@ func Test_Validate(t *testing.T) {
 			},
 			expectedErr: "",
 		},
+		{
+			name: "BasePath no leading slash",
+			config: &Config{
+				QueryOptions: queryapp.QueryOptions{BasePath: "no-leading-slash"},
+				Storage:      Storage{TracesPrimary: "some-storage"},
+			},
+			expectedErr: "invalid base_path",
+		},
+		{
+			name: "BasePath trailing slash normalized",
+			config: &Config{
+				QueryOptions: queryapp.QueryOptions{BasePath: "/jaeger/"},
+				Storage:      Storage{TracesPrimary: "some-storage"},
+			},
+			expectedErr:      "",
+			expectedBasePath: "/jaeger",
+		},
+		{
+			name: "BasePath duplicate slashes rejected",
+			config: &Config{
+				QueryOptions: queryapp.QueryOptions{BasePath: "/jaeger//foo"},
+				Storage:      Storage{TracesPrimary: "some-storage"},
+			},
+			expectedErr: "invalid base_path",
+		},
+		{
+			name: "BasePath double leading slash rejected",
+			config: &Config{
+				QueryOptions: queryapp.QueryOptions{BasePath: "//jaeger"},
+				Storage:      Storage{TracesPrimary: "some-storage"},
+			},
+			expectedErr: "invalid base_path",
+		},
+		{
+			name: "BasePath path traversal rejected",
+			config: &Config{
+				QueryOptions: queryapp.QueryOptions{BasePath: "/jaeger/../other"},
+				Storage:      Storage{TracesPrimary: "some-storage"},
+			},
+			expectedErr: "invalid base_path",
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			err := tt.config.Validate()
 			if tt.expectedErr == "" {
 				require.NoError(t, err)
+				if tt.expectedBasePath != "" {
+					assert.Equal(t, tt.expectedBasePath, tt.config.BasePath)
+				}
 			} else {
-				assert.Equal(t, tt.expectedErr, err.Error())
+				assert.ErrorContains(t, err, tt.expectedErr)
 			}
 		})
 	}

cmd/jaeger/internal/extension/jaegerquery/internal/static_handler.go

@@ -30,7 +30,6 @@ var (
 	configJsPattern    = regexp.MustCompile(`(?im)^\s*//\s*JAEGER_CONFIG_JS.*\n.*`)
 	versionPattern     = regexp.MustCompile("JAEGER_VERSION *= *DEFAULT_VERSION;")
 	compabilityPattern = regexp.MustCompile("JAEGER_STORAGE_CAPABILITIES *= *DEFAULT_STORAGE_CAPABILITIES;")
-	basePathPattern    = regexp.MustCompile(`<base href="/"`) // Note: tag is not closed
 )
 
 // RegisterStaticHandler adds handler for static assets to the router.
@@ -119,16 +118,8 @@ func (sH *StaticAssetsHandler) loadAndEnrichIndexHTML(open func(string) (http.Fi
 	versionJSON, _ := json.Marshal(version.Get())
 	versionString := fmt.Sprintf("JAEGER_VERSION = %s;", string(versionJSON))
 	indexBytes = versionPattern.ReplaceAll(indexBytes, []byte(versionString))
-	// replace base path
-	if sH.options.BasePath == "" {
-		sH.options.BasePath = "/"
-	}
-	if sH.options.BasePath != "/" {
-		if !strings.HasPrefix(sH.options.BasePath, "/") || strings.HasSuffix(sH.options.BasePath, "/") {
-			return nil, fmt.Errorf("invalid base path '%s'. Must start but not end with a slash '/', e.g. '/jaeger/ui'", sH.options.BasePath)
-		}
-		indexBytes = basePathPattern.ReplaceAll(indexBytes, fmt.Appendf(nil, `<base href="%s/"`, sH.options.BasePath))
-	}
+	// The <base href> is no longer injected here. The UI detects its own mount-point
+	// prefix at page-load time via an inline script in index.html (see ADR-009).
 
 	return indexBytes, nil
 }

cmd/jaeger/internal/extension/jaegerquery/internal/static_handler_test.go

@@ -65,15 +65,13 @@ func TestRegisterStaticHandler(t *testing.T) {
 		archiveStorage              bool   // archive storage enabled?
 		metricsStorage              bool   // metrics storage enabled?
 		logAccess                   bool
-		expectedBaseHTML            string // substring to match in the home page
 		UIConfigPath                string // path to UI config
 		expectedUIConfig            string // expected UI config
 		expectedStorageCapabilities string // expected storage capabilities
 	}{
 		{
 			basePath:                    "",
 			baseURL:                     "/",
-			expectedBaseHTML:            `<base href="/"`,
 			archiveStorage:              false,
 			logAccess:                   true,
 			UIConfigPath:                "",
@@ -84,15 +82,13 @@ func TestRegisterStaticHandler(t *testing.T) {
 			basePath:                    "/",
 			baseURL:                     "/",
 			archiveStorage:              false,
-			expectedBaseHTML:            `<base href="/"`,
 			UIConfigPath:                "fixture/ui-config.json",
 			expectedUIConfig:            `JAEGER_CONFIG = {"x":"y"};`,
 			expectedStorageCapabilities: `JAEGER_STORAGE_CAPABILITIES = {"archiveStorage":false,"metricsStorage":false};`,
 		},
 		{
 			basePath:                    "/jaeger",
 			baseURL:                     "/jaeger/",
-			expectedBaseHTML:            `<base href="/jaeger/"`,
 			subroute:                    true,
 			archiveStorage:              true,
 			UIConfigPath:                "fixture/ui-config.js",
@@ -102,7 +98,6 @@ func TestRegisterStaticHandler(t *testing.T) {
 		{
 			basePath:                    "/metrics",
 			baseURL:                     "/metrics/",
-			expectedBaseHTML:            `<base href="/metrics/"`,
 			subroute:                    true,
 			metricsStorage:              true,
 			UIConfigPath:                "fixture/ui-config.js",
@@ -149,7 +144,12 @@ func TestRegisterStaticHandler(t *testing.T) {
 			assert.Contains(t, html, testCase.expectedUIConfig, "actual: %v", html)
 			assert.Contains(t, html, testCase.expectedStorageCapabilities, "actual: %v", html)
 			assert.Contains(t, html, `JAEGER_VERSION = {"gitCommit":"","gitVersion":"dev","buildDate":""};`, "actual: %v", html)
-			assert.Contains(t, html, testCase.expectedBaseHTML, "actual: %v", html)
+			// Verify the inline base-path script marker is present and the backend
+			// did not rewrite <base href> to a path-specific value (ADR-009).
+			assert.Contains(t, html, `data-inject-target="BASE_URL"`, "<base> tag must carry data-inject-target marker for client-side base-path detection")
+			if testCase.basePath != "" && testCase.basePath != "/" {
+				assert.NotContains(t, html, `<base href="`+testCase.baseURL+`"`, "backend must not inject path-specific <base href>")
+			}
 
 			asset := httpGet("static/asset.txt")
 			assert.Contains(t, asset, "some asset", "actual: %v", asset)
@@ -170,17 +170,6 @@ func TestNewStaticAssetsHandlerErrors(t *testing.T) {
 		Logger: zap.NewNop(),
 	})
 	require.Error(t, err)
-
-	for _, base := range []string{"x", "x/", "/x/"} {
-		_, err := NewStaticAssetsHandler("fixture", StaticAssetsHandlerOptions{
-			UIConfig: UIConfig{
-				ConfigFile: "fixture/ui-config.json",
-			},
-			BasePath: base,
-			Logger:   zap.NewNop(),
-		})
-		assert.ErrorContainsf(t, err, "invalid base path", "basePath=%s", base)
-	}
 }
 
 func TestHotReloadUIConfig(t *testing.T) {