mirror of
https://github.com/caddyserver/caddy.git
synced 2026-10-25 13:31:58 +00:00
fb324331f4
Both fallbacks in splitPos relied on golang.org/x/text/search with search.IgnoreCase, which performs Unicode equivalence matching far beyond ASCII case folding. Combined with the validated-ASCII guarantee on every SplitPath entry, that fallback turned non-PHP filenames into PHP scripts: - when the inner loop hit a non-ASCII byte and the IndexString fallback returned -1, the loop broke without resetting match=false, so a stale match=true caused a non-existent .php to be reported (PoC: "/name.<U+00A1>.txt"). - search.IgnoreCase folded fullwidth, mathematical and circled letters onto ASCII, so "/shell.<math sans-serif php>", "/shell.<fullwidth p>hp", "/shell.<circled php>" were all detected as ".php" files. Replace the fallback with strict byte-level ASCII case-insensitive matching: any byte >= utf8.RuneSelf in the path can never be part of a match, since SplitPath entries are validated ASCII-only and lower-cased in Provision(). This keeps the hot path branch-light and removes the x/text/search dependency from the main module. Reported against FrankenPHP as GHSA-3g8v-8r37-cgjm and GHSA-v4h7-cj44-8fc8. The vulnerable function in this module was adapted from the same FrankenPHP code. |
||
|---|---|---|
| .. | ||
| caddyauth | ||
| encode | ||
| fileserver | ||
| headers | ||
| intercept | ||
| logging | ||
| map | ||
| proxyprotocol | ||
| push | ||
| requestbody | ||
| reverseproxy | ||
| rewrite | ||
| standard | ||
| templates | ||
| tracing | ||
| app.go | ||
| autohttps.go | ||
| autohttps_test.go | ||
| caddyhttp.go | ||
| caddyhttp_test.go | ||
| celmatcher.go | ||
| celmatcher_test.go | ||
| errors.go | ||
| http2listener.go | ||
| httpredirectlistener.go | ||
| invoke.go | ||
| ip_matchers.go | ||
| ip_range.go | ||
| logging.go | ||
| marshalers.go | ||
| matchers.go | ||
| matchers_test.go | ||
| metrics.go | ||
| metrics_test.go | ||
| replacer.go | ||
| replacer_test.go | ||
| responsematchers.go | ||
| responsematchers_test.go | ||
| responsewriter.go | ||
| responsewriter_test.go | ||
| routes.go | ||
| server.go | ||
| server_test.go | ||
| staticerror.go | ||
| staticresp.go | ||
| staticresp_test.go | ||
| subroute.go | ||
| vars.go | ||
| vars_test.go | ||