From 1dc2a394e6b39f355a558530572adc4f00888d8a Mon Sep 17 00:00:00 2001
From: Oliver Gugger <gugger@gmail.com>
Date: Wed, 23 Mar 2022 17:40:35 +0100
Subject: [PATCH 1/2] lnd: disable REST proxy HTTP method fallback

It turns out that when a REST call to an endpoint (in this specific
example /v1/payments, which for GET returns all payments but for DELETE
removes all payments) is made with POST instead of the correct
registered method, the grpc-gateway tried to find a fallback method.
That resulted in randomly choosing between any of the calls with the
same URI pattern.
This is of course catasrophic if the user attempts to query the list of
payments (but using POST instead of GET by accident) and then ending up
calling the DELETE endpoint instead.
---
 lnd.go | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lnd.go b/lnd.go
index 6a6d94658..eb57995d2 100644
--- a/lnd.go
+++ b/lnd.go
@@ -973,7 +973,16 @@ func startRestProxy(cfg *Config, rpcServer *rpcServer, restDialOpts []grpc.DialO
 			},
 		},
 	)
-	mux := proxy.NewServeMux(customMarshalerOption)
+	mux := proxy.NewServeMux(
+		customMarshalerOption,
+
+		// Don't allow falling back to other HTTP methods, we want exact
+		// matches only. The actual method to be used can be overwritten
+		// by setting X-HTTP-Method-Override so there should be no
+		// reason for not specifying the correct method in the first
+		// place.
+		proxy.WithDisablePathLengthFallback(),
+	)
 
 	// Register our services with the REST proxy.
 	err := lnrpc.RegisterStateHandlerFromEndpoint(

From ba99d22f3c1d376f28b838f53f8943b86ac0dfcf Mon Sep 17 00:00:00 2001
From: Oliver Gugger <gugger@gmail.com>
Date: Wed, 23 Mar 2022 17:46:58 +0100
Subject: [PATCH 2/2] docs: update release notes

---
 docs/release-notes/release-notes-0.14.3.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 docs/release-notes/release-notes-0.14.3.md

diff --git a/docs/release-notes/release-notes-0.14.3.md b/docs/release-notes/release-notes-0.14.3.md
new file mode 100644
index 000000000..6b616d7a0
--- /dev/null
+++ b/docs/release-notes/release-notes-0.14.3.md
@@ -0,0 +1,13 @@
+# Release Notes
+
+## Bug fixes
+
+* The REST proxy (`grpc-gateway` library) had a fallback that redirected `POST`
+  requests to another endpoint _with the same URI_ if no endpoint for `POST` was
+  registered. [This default behavior was turned
+  off](https://github.com/lightningnetwork/lnd/pull/6359), enabling strict
+  HTTP method matching.
+
+# Contributors (Alphabetical Order)
+
+* Oliver Gugger