From e59aee02bd528e5cbef3671e59838cc7f9926083 Mon Sep 17 00:00:00 2001
From: akshya96 <87045294+akshya96@users.noreply.github.com>
Date: Thu, 24 Mar 2022 12:19:14 -0700
Subject: [PATCH] Vault-4010 Unauthenticated panic when processing "help"
 requests (#14704)

* fix help panic

* add changelog entry
---
 changelog/14704.txt | 3 +++
 http/help.go        | 6 ++++++
 http/help_test.go   | 6 +++++-
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 changelog/14704.txt

diff --git a/changelog/14704.txt b/changelog/14704.txt
new file mode 100644
index 000000000..e5663e1c9
--- /dev/null
+++ b/changelog/14704.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix panic for help request URL paths without /v1/ prefix   
+```
\ No newline at end of file
diff --git a/http/help.go b/http/help.go
index 45099bd7b..7ec6fb613 100644
--- a/http/help.go
+++ b/http/help.go
@@ -1,7 +1,9 @@
 package http
 
 import (
+	"errors"
 	"net/http"
+	"strings"
 
 	"github.com/hashicorp/vault/helper/namespace"
 	"github.com/hashicorp/vault/sdk/logical"
@@ -31,6 +33,10 @@ func handleHelp(core *vault.Core, w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusBadRequest, nil)
 		return
 	}
+	if !strings.HasPrefix(r.URL.Path, "/v1/") {
+		respondError(w, http.StatusNotFound, errors.New("Missing /v1/ prefix in path. Use vault path-help command to retrieve API help for paths"))
+		return
+	}
 	path := ns.TrimmedPath(r.URL.Path[len("/v1/"):])
 
 	req := &logical.Request{
diff --git a/http/help_test.go b/http/help_test.go
index c3abfc86f..ec9a67dd1 100644
--- a/http/help_test.go
+++ b/http/help_test.go
@@ -13,7 +13,11 @@ func TestHelp(t *testing.T) {
 	defer ln.Close()
 	TestServerAuth(t, addr, token)
 
-	resp := testHttpGet(t, "", addr+"/v1/sys/mounts?help=1")
+	// request without /v1/ prefix
+	resp := testHttpGet(t, token, addr+"/?help=1")
+	testResponseStatus(t, resp, 404)
+
+	resp = testHttpGet(t, "", addr+"/v1/sys/mounts?help=1")
 	if resp.StatusCode != http.StatusForbidden {
 		t.Fatal("expected permission denied with no token")
 	}