github-mirror/caddy
2
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2024-11-25 09:40:13 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Also reject null byte

Browse Source
This commit is contained in:
Matthew Holt 2022-06-14 11:37:37 -06:00
parent 98cd4333a1
commit 1e6eed42bd
No known key found for this signature in database
GPG Key ID: 2A349DD577D586A5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/caddyhttp/server.go
View File

@ -348,7 +348,7 @@ func (strict *StrictOptions) enforce(r *http.Request) error {
// Reject paths with // or .. // Reject paths with // or ..
if strict == nil || !strict.LenientPaths { if strict == nil || !strict.LenientPaths {
if strings.Contains(r.URL.Path, "//") || strings.Contains(r.URL.Path, "..") { if strings.Contains(r.URL.Path, "//") || strings.Contains(r.URL.Path, "..") || strings.Contains(r.URL.Path, "\x00") {
return Error(http.StatusBadRequest, fmt.Errorf("invalid request path: %s", r.URL.RawPath)) return Error(http.StatusBadRequest, fmt.Errorf("invalid request path: %s", r.URL.RawPath))
} }
} }