Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

caddyhttp: Smarter path matching and rewriting #4948

Merged
merged 15 commits into from
Aug 16, 2022
Merged

caddyhttp: Smarter path matching and rewriting #4948

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
9c1eb32
caddyhttp: Consistent URI-decoded (unescaped) form
mholt Aug 8, 2022
df254da
caddyhttp: Support %* wildcard in path matcher
mholt Aug 10, 2022
d0cf5c7
Allow matching on literal escape sequences
mholt Aug 10, 2022
9491cdf
Try to get tests passing on Windows
mholt Aug 10, 2022
0afcdfa
Another attempt for Windows
mholt Aug 10, 2022
3eb4b8f
Another attempt for Windows
mholt Aug 10, 2022
b8ec9b0
Fix bugs, add tests, clean up path matcher
mholt Aug 11, 2022
ed590a5
rewrite: Begin enhancements and bug fixes
mholt Aug 11, 2022
9bfb2cd
Generalize CleanPath(); enhance rewrite to fix #4743
mholt Aug 11, 2022
2fd8532
Update rewrite docs
mholt Aug 11, 2022
a5662a8
rewrite: Honor escapes in prefix/suffix to trim (fix #4801)
mholt Aug 12, 2022
2d06890
Remove unnecessary condition
mholt Aug 12, 2022
832855e
Clarify rewrite docs
mholt Aug 12, 2022
9c18250
Fix path traversal parsing
mholt Aug 16, 2022
b47a7a4
caddyhttp: Simplify CleanPath()
RussellLuo Aug 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 1 addition & 11 deletions modules/caddyhttp/fileserver/staticfiles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ import (
weakrand "math/rand"
"mime"
"net/http"
"net/url"
"os"
"path"
"path/filepath"
Expand Down Expand Up @@ -236,16 +235,7 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request, next c
filesToHide := fsrv.transformHidePaths(repl)

root := repl.ReplaceAll(fsrv.Root, ".")
// PathUnescape returns an error if the escapes aren't well-formed,
// meaning the count % matches the RFC. Return early if the escape is
// improper.
if _, err := url.PathUnescape(r.URL.Path); err != nil {
fsrv.logger.Debug("improper path escape",
zap.String("site_root", root),
zap.String("request_path", r.URL.Path),
zap.Error(err))
return err
}

filename := caddyhttp.SanitizedPathJoin(root, r.URL.Path)

fsrv.logger.Debug("sanitized path join",
Expand Down
Loading