From 626b03c6846765f7ce6618f163fcba5356eb8f10 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Tue, 18 Nov 2025 15:40:42 +0100
Subject: [PATCH] gateway-backend: ignore negative hop counts

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 plugins/gateway-backend/src/plugin.test.ts | 20 ++++++++++++++++++++
 plugins/gateway-backend/src/router.ts      |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/plugins/gateway-backend/src/plugin.test.ts b/plugins/gateway-backend/src/plugin.test.ts
index b7619e3dfc..8db99e39a5 100644
--- a/plugins/gateway-backend/src/plugin.test.ts
+++ b/plugins/gateway-backend/src/plugin.test.ts
@@ -176,6 +176,26 @@ describe('gateway', () => {
     });
   });
 
+  it('should detect looped requests with intentional negative hop count', async () => {
+    const response = await fetch(
+      'http://localhost:7777/api/nonexistent-plugin/foo',
+      {
+        headers: {
+          'backstage-gateway-hops': '-1000000',
+        },
+      },
+    );
+    expect(response.status).toBe(508);
+
+    const data = await response.json();
+    expect(data).toEqual({
+      error: {
+        name: 'LoopDetectedError',
+        message: 'Maximum proxy hop count exceeded (3)',
+      },
+    });
+  });
+
   it('should close the response for sse connections', async () => {
     const eventSource = new EventSource(
       'http://localhost:7777/api/external-plugin/endpoint-sse',
diff --git a/plugins/gateway-backend/src/router.ts b/plugins/gateway-backend/src/router.ts
index f04bd3ee58..6c9b4ba6c7 100644
--- a/plugins/gateway-backend/src/router.ts
+++ b/plugins/gateway-backend/src/router.ts
@@ -47,7 +47,7 @@ export async function createRouter({
     on: {
       proxyReq(proxyReq, req: Request<{ pluginId: string }>) {
         const currentHops =
-          parseInt(req.headers[HOPS_HEADER] as string, 10) || 0;
+          Math.max(parseInt(req.headers[HOPS_HEADER] as string, 10), 0) || 0;
 
         proxyReq.setHeader(HOPS_HEADER, currentHops + 1);
       },