fix(middleware): read $10 and above as one capture in rewrite targets

middleware/middleware.go

@@ -24,11 +24,11 @@ func captureTokens(pattern *regexp.Regexp, input string) *strings.Replacer {
 		return nil
 	}
 	values := groups[0][1:]
-	replace := make([]string, 2*len(values))
-	for i, v := range values {
-		j := 2 * i
-		replace[j] = "$" + strconv.Itoa(i+1)
-		replace[j+1] = v
+	// strings.Replacer tries old strings in argument order, so list the highest
+	// index first. Otherwise "$1" matches the start of "$10".
+	replace := make([]string, 0, 2*len(values))
+	for i := len(values); i > 0; i-- {
+		replace = append(replace, "$"+strconv.Itoa(i), values[i-1])
 	}
 	return strings.NewReplacer(replace...)
 }

middleware/rewrite_test.go

@@ -315,3 +315,33 @@ func TestEchoRewriteReplacementEscaping(t *testing.T) {
 		})
 	}
 }
+
+func TestEchoRewriteTwoDigitCaptures(t *testing.T) {
+	e := echo.New()
+
+	e.Pre(RewriteWithConfig(RewriteConfig{
+		Rules: map[string]string{
+			"^/t/*/*/*/*/*/*/*/*/*/*/*": "/r/$11/$10/$1",
+		},
+		RegexRules: map[*regexp.Regexp]string{
+			regexp.MustCompile("^/x/(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)(.)$"): "/v/$11/$10/$1",
+		},
+	}))
+
+	testCases := []struct {
+		requestPath string
+		expectPath  string
+	}{
+		{"/t/a/b/c/d/e/f/g/h/i/j/k", "/r/k/j/a"},
+		{"/x/abcdefghijk", "/v/k/j/a"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.requestPath, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, tc.requestPath, nil)
+			rec := httptest.NewRecorder()
+			e.ServeHTTP(rec, req)
+			assert.Equal(t, tc.expectPath, req.URL.EscapedPath())
+		})
+	}
+}