caddy/caddyhttp/rewrite/to.go
Matt Holt d5371aff22 httpserver/all: Clean up and standardize request URL handling (#1633)
* httpserver/all: Clean up and standardize request URL handling

The HTTP server now always creates a context value on the request which
is a copy of the request's URL struct. It should not be modified by
middlewares, but it is safe to get the value out of the request and make
changes to it locally-scoped. Thus, the value in the context always
stores the original request URL information as it was received. Any
rewrites that happen will be to the request's URL field directly.

The HTTP server no longer cleans /sanitizes the request URL. It made too
many strong assumptions and ended up making a lot of middleware more
complicated, including upstream proxying (and fastcgi). To alleviate
this complexity, we no longer change the request URL. Middlewares are
responsible to access the disk safely by using http.Dir or, if not
actually opening files, they can use httpserver.SafePath().

I'm hoping this will address issues with #1624, #1584, #1582, and others.

* staticfiles: Fix test on Windows

@abiosoft: I still can't figure out exactly what this is for. 😅

* Use (potentially) changed URL for browse redirects, as before

* Use filepath.ToSlash, clean up a couple proxy test cases

* Oops, fix variable name
2017-05-01 23:11:10 -06:00

90 lines
1.7 KiB
Go

package rewrite
import (
"log"
"net/http"
"net/url"
"path"
"strings"
"github.com/mholt/caddy/caddyhttp/httpserver"
)
// To attempts rewrite. It attempts to rewrite to first valid path
// or the last path if none of the paths are valid.
func To(fs http.FileSystem, r *http.Request, to string, replacer httpserver.Replacer) Result {
tos := strings.Fields(to)
// try each rewrite paths
t := ""
query := ""
for _, v := range tos {
t = replacer.Replace(v)
tparts := strings.SplitN(t, "?", 2)
t = path.Clean(tparts[0])
if len(tparts) > 1 {
query = tparts[1]
}
// add trailing slash for directories, if present
if strings.HasSuffix(tparts[0], "/") && !strings.HasSuffix(t, "/") {
t += "/"
}
// validate file
if validFile(fs, t) {
break
}
}
// validate resulting path
u, err := url.Parse(t)
if err != nil {
// Let the user know we got here. Rewrite is expected but
// the resulting url is invalid.
log.Printf("[ERROR] rewrite: resulting path '%v' is invalid. error: %v", t, err)
return RewriteIgnored
}
// perform rewrite
r.URL.Path = u.Path
if query != "" {
// overwrite query string if present
r.URL.RawQuery = query
}
if u.Fragment != "" {
// overwrite fragment if present
r.URL.Fragment = u.Fragment
}
return RewriteDone
}
// validFile checks if file exists on the filesystem.
// if file ends with `/`, it is validated as a directory.
func validFile(fs http.FileSystem, file string) bool {
if fs == nil {
return false
}
f, err := fs.Open(file)
if err != nil {
return false
}
defer f.Close()
stat, err := f.Stat()
if err != nil {
return false
}
// directory
if strings.HasSuffix(file, "/") {
return stat.IsDir()
}
// file
return !stat.IsDir()
}