2604 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Francis Lavoie	a0552dc0d4	rewrite: Add option to force modifying the query	2026-06-14 18:38:12 -04:00
Luccin Masirika	39c9a85f80	fileserver: append repeated hide subdirectives instead of overwriting (#7817) ... Multiple `hide` subdirectives in a file_server Caddyfile block silently overwrote each other, so only the last one took effect. Append to the list instead, so repeated entries accumulate and imported snippets can compose with site-specific hides.	2026-06-13 22:44:19 +10:00
long.black	16235cced5	intercept: fix replace_status being silently dropped (#7810) ... * test: add failing tests for intercept replace_status (#7805) Add integration tests that verify replace_status actually substitutes the HTTP status code sent to the client. Currently these tests fail because replace_status is silently a no-op due to value-receiver boxing and shouldBuffer returning false. Tests added: - TestInterceptReplaceStatusWithMatcher: 500 -> 200 with @err matcher - TestInterceptReplaceStatusWithoutMatcher: 403 -> 200 unconditionally - TestInterceptReplaceStatusNotMatched: 200 passes through unchanged * fix: make intercept replace_status actually substitute the status code Fix #7805: replace_status was silently a no-op because: 1. shouldBuffer returned false when a replacement status was set, causing the original status to be streamed directly to the wire 2. The value-receiver WriteHeader method operated on a stale copy The fix: - shouldBuffer now returns true when replace_status matches, so the response is buffered instead of streamed - After next.ServeHTTP returns, if routes are nil (replace_status only), write the substituted status and buffered body to the client The interceptedResponseHandler.WriteHeader substitution branch is no longer needed for this path since substitution happens post-ServeHTTP. * refactor: remove dead WriteHeader method and resolved TODO The value-receiver WriteHeader on interceptedResponseHandler was unreachable dead code — the substitution is now handled post-ServeHTTP via buffering. Remove it along with the TODO comment that noted status code replacement was unfinished. * style: apply nit suggestions from dunglas code review Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-12 15:50:58 -06:00
alhuda	52dc6709fb	rewrite: fix wrong index check in trimPathPrefix (#7812)	2026-06-12 14:11:21 -06:00
Dionis Ramadani	25b3eab6db	Merge commit from fork ... * fix(reverseproxy): hop-by-hop header fix * test(headers): Added unit tests for hop-by-hope header behavior	2026-06-12 12:39:01 -06:00
Bluegate Studio	fcba554d65	caddyhttp: New expected_underscore_headers server option (#7809) ... * caddyhttp: restore allow_underscore_in_headers server option (#7808) * caddyhttp: mark insecure_allow_underscore_in_headers as EXPERIMENTAL * caddyhttp: replace underscore bool with expected_underscore_headers allowlist * fix gofmt alignment in serveroptions.go * caddyhttp: drop repeated allowlisted underscore headers * caddyhttp: add tests for repeated-value drop and variant-drop logging	2026-06-11 22:26:21 -06:00
Sam Ottenhoff	997d3f6b0a	encode: add standard benchmark and conformance harness (#7804) ... This is a shared encode_test harness with HTML/JSON/JS/CSS payloads taken from caddyserver.com Benchmarks: - BenchmarkStandardEncodingPayloads: raw encoder NewEncoder/Write/Close path - BenchmarkEncodeHandlerCorpus: full Encode.ServeHTTP middleware path - Grid: 4 payloads × gzip levels 1/5/9 × zstd fastest/default/best - Each subtest runs with 4 parallel workers; compare runs on MB/s and allocs/op Conformance tests: - Encoder contract: Reset, Flush, Close, and pool-style Reset-after-Close reuse - Corpus HTTP encoding: Content-Encoding, Vary, ETag suffix, header stripping - Response semantics: minimum_length, 304, HEAD, range, WebSocket bypass, If-None-Match rewrite, Cache-Control no-transform, content-type matcher rejection	2026-06-11 17:55:18 -06:00
Rhul	0f7f8e9cf6	forwardauth: error on duplicate uri subdirective (#7814)	2026-06-10 23:31:04 -04:00
Matthew Holt	4fd8c87f56	caddyhttp: Default max_header_bytes to 16 KiB	2026-06-09 12:07:27 -06:00
Rhul	55b3397a2d	reverseproxy: validate on weighted_round_robin loadbalancing policy (#7807) ... * reverseproxy: validate on weighted_round_robin policy Validate that weighted_round_robin has a non-zero total weight. This prevents configurations such as: weighted_round_robin 0 0 from being accepted and causing a divide-by-zero panic during request handling. * test: validation test on zero weight upstreams. * test: provision called instead of totalweight setting * reverseproxy: validate on negative upstream weights * test: regression test on weighted_round_robin selection policy	2026-06-08 02:18:20 +10:00
Micky	d3986f824d	Add missing "is" (#7802) ... Signed-off-by: Micky <60691199+AliMickey@users.noreply.github.com>	2026-06-06 21:02:51 +00:00
Y.Horie	d730df2a83	cmd: colored error message in WrapCommandFuncForCobra (#7760) (#7768) ... Signed-off-by: Y.Horie <u5.horie@gmail.com> Co-authored-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2026-06-04 21:41:35 -04:00
Rhul	3b7bde8f25	httpcaddyfile: error on duplicate named_routes (#7800) ... * fix: error on duplicate named_routes Fixes issue #7798 Validate named route names before inserting them into the named route map. This prevents later definitions from overwriting existing named routes and returns an error when a route name is defined more than once. * test: add test for duplicate named_routes	2026-06-04 14:55:08 -04:00
Muhammad Syafri, S.Kom	915793f6e0	caddyhttp: add {http.request.proto_name} placeholder for spec-compliant protocol names (#7782) ... * caddyhttp: add {http.request.proto_name} placeholder for spec-compliant protocol names {http.request.proto} exposes Go's raw http.Request.Proto field which returns HTTP/2.0 and HTTP/3.0 for HTTP/2 and HTTP/3 respectively. These strings are non-standard since the specs define them as HTTP/2 and HTTP/3. To preserve backward compat (especially CGI/FastCGI expectations), {http.request.proto} is kept as-is. A new {http.request.proto_name} placeholder is introduced that normalises the version string to the spec-defined form: HTTP/2.0 -> HTTP/2 HTTP/3.0 -> HTTP/3 all others returned unchanged Closes #7734 * caddyhttp: Use ProtoMajor for proto_name normalization and update docs --------- Co-authored-by: jalikajalika5 <105954036+jalikajalika5@users.noreply.github.com>	2026-06-04 11:03:19 -04:00
WeidiDeng	fcc7860d03	reverseproxy: replace placeholders specified for sni while using http3 (#7737) ... * reverseproxy: replace placeholders specified for sni while using http3 * add test for placeholder * reverseproxy: replace placeholders specified for sni while using http3 * add test for placeholder * reverseproxy: test HTTP/3 SNI host placeholder --------- Co-authored-by: Zen Dodd <mail@steadytao.com>	2026-06-02 21:49:00 -06:00
JM Sanchez	e2eee6a7fc	templates: Patch for GHSA-vcc4-2c75-vc9v (#7785) ... * Patch GHSA-vcc4-2c75-vc9v in stripHTML templates: fix funcStripHTML bypass via depth counter The previous false-start approach allowed XSS bypass via inputs like <<>img src=x onerror=alert(1)> and failed on stacked angle brackets. Replace the tagStart/inTag state machine with a depth counter that mirrors PHP strip_tags behaviour: each '<' increments depth, each '>' decrements it, and text is only emitted at depth zero. Quoted attribute values (both single and double) are tracked so '>' inside href values does not prematurely close a tag. Signed-off-by: JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com> * Update tplcontext_test.go Templates: expand TestStripHTML with attack path coverage Signed-off-by: JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com> --------- Signed-off-by: JM Sanchez <77505889+jmrcsnchz@users.noreply.github.com>	2026-06-01 13:35:02 -06:00
Bruno Teixeira Lopes	0e8eb41b87	httpcaddyfile: fix incorrect error message on duplicate matchers (#7780) ... Parse each matcher segment individually using NewDispenser(segment) instead of DispenseDirective(dir), which coalesced all same-name segments into one token stream. This caused the second definition name to be misinterpreted as a matcher module name, producing 'module not registered: http.matchers.@name' instead of the correct 'matcher is defined more than once' error. By parsing segments individually, the existing duplicate check in parseMatcherDefinitions naturally catches the duplicate on the second pass. Signed-off-by: Brunotlps <brunoteixlps@gmail.com>	2026-05-30 07:05:41 +10:00
Kévin Dunglas	3eb8e48ff0	Merge commit from fork ... * feat: drop headers with underscore in their names * feat: Caddyfile binding and tests for underscore-in-header drop Add the `allow_underscore_in_headers` global server option, refine the doc comment, and cover the filter end-to-end: server-level unit tests (drop, opt-out, debug log, RFC-7230 space rejection), a fastcgi unit test for the trimmed header name replacer, and forward_auth integration tests for both the default-drop and opt-out paths. * remove allow_underscore_in_headers option for now	2026-05-29 11:37:17 -06:00
Muhammad Syafri, S.Kom	03e08ee6a9	encode: prioritize zstd and br over gzip in content negotiation (#7772) ... * fix(encode): prioritize zstd and br over gzip in content negotiation * test(encode): update unit tests to reflect new default priority ties * fix(encode): move default preferences to dynamic encode handler and restore generic negotiation helper * test(encode): call real Provision function in served-response test * test(encode): rename served-response test to TestServeHTTPDefaultEncodingPreference * refactor(encode): use slices.SortStableFunc and httptest.NewRecorder as recommended * refactor(encode): simplify sorting with cmp.Compare and check request error in test * test(encode): fix variable redeclaration in TestServeHTTPDefaultEncodingPreference Fix 'no new variables on left side of :=' error by changing 'err :=' to 'err =' on line 347, since err was already declared on line 332. This fixes the build failure in the encode module tests.	2026-05-29 05:26:19 +10:00
gelsomino	86121c860f	caddytls: skip idna.ToASCII for pure ASCII SNI values (#7770) ... SNI is always ASCII on the wire (RFC 6066), and most config patterns are also ASCII. For pure ASCII input, idna.ToASCII only validates and lowercases, which is equivalent to a simple strings.ToLower. Add a fast path to avoid the overhead of idna.ToASCII in the common case.	2026-05-28 11:18:09 +10:00
Muhammad Syafri, S.Kom	4d60d936ed	perf(replacer): optimize memory allocation for file placeholders (#7773) ... Co-authored-by: jalikajalika5 <105954036+jalikajalika5@users.noreply.github.com>	2026-05-27 14:20:33 +00:00
Lohit	176b043b01	rewrite: prevent placeholder re-expansion in injected query (#7761) ... When the rewrite URI template ends with a literal '?' and contains a placeholder that expands to client-controlled bytes (e.g. {http.request.header.X-Fwd}), those bytes flow into buildQueryString which runs a second Replacer pass. If the bytes contain placeholder syntax such as {env.SECRET}, that placeholder is evaluated, allowing disclosure of environment variables, files (via {file./path}), or internal request vars through the rewritten request URI. Escape '{' and '}' in the injected query before assigning it to the query variable, so the second pass cannot find any placeholder syntax to evaluate. Operator-written placeholders in the rewrite template are already expanded by the first pass on the path component, so the only '{' or '}' surviving into the injected query must have come from replacement values. Fixes GHSA-j8px-rmrx-76h9. Includes three regression tests mirroring the 'is not re-expanded' tests in modules/caddyhttp/vars_test.go. Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2026-05-26 16:51:18 -06:00
Matthew Holt	4c04143261	Clarify policies for agents / LLM use	2026-05-26 14:03:39 -06:00
Zen Dodd	94fcea08f4	go.mod: update x/net (#7767)	2026-05-25 12:24:44 -04:00
Matthew Holt	44b667a79f	go.mod: Update x/crypto	2026-05-22 09:25:04 -06:00
Vincent Yang	217a785824	caddyhttp: normalize Windows backslashes in path matcher (#7763)	2026-05-21 11:28:40 -06:00
dependabot[bot]	b5898c3f32	build(deps): bump the all-updates group across 1 directory with 9 updates (#7752) ... Bumps the all-updates group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github.com/alecthomas/chroma/v2](https://github.com/alecthomas/chroma) | `2.23.1` | `2.24.1` | | [github.com/google/cel-go](https://github.com/google/cel-go) | `0.28.0` | `0.28.1` | | [github.com/klauspost/compress](https://github.com/klauspost/compress) | `1.18.5` | `1.18.6` | | [go.opentelemetry.io/contrib/exporters/autoexport](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.65.0` | `0.68.0` | | [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.67.0` | `0.68.0` | | [go.opentelemetry.io/contrib/propagators/autoprop](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.65.0` | `0.68.0` | | [go.uber.org/zap](https://github.com/uber-go/zap) | `1.27.1` | `1.28.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.53.0` | `0.54.0` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.11.0` | `0.12.0` | Updates `github.com/alecthomas/chroma/v2` from 2.23.1 to 2.24.1 - [Release notes](https://github.com/alecthomas/chroma/releases) - [Commits](https://github.com/alecthomas/chroma/compare/v2.23.1...v2.24.1) Updates `github.com/google/cel-go` from 0.28.0 to 0.28.1 - [Release notes](https://github.com/google/cel-go/releases) - [Commits](https://github.com/google/cel-go/compare/v0.28.0...v0.28.1) Updates `github.com/klauspost/compress` from 1.18.5 to 1.18.6 - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.18.5...v1.18.6) Updates `go.opentelemetry.io/contrib/exporters/autoexport` from 0.65.0 to 0.68.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.65.0...zpages/v0.68.0) Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.67.0 to 0.68.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.67.0...zpages/v0.68.0) Updates `go.opentelemetry.io/contrib/propagators/autoprop` from 0.65.0 to 0.68.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go-contrib/compare/zpages/v0.65.0...zpages/v0.68.0) Updates `go.uber.org/zap` from 1.27.1 to 1.28.0 - [Release notes](https://github.com/uber-go/zap/releases) - [Changelog](https://github.com/uber-go/zap/blob/master/CHANGELOG.md) - [Commits](https://github.com/uber-go/zap/compare/v1.27.1...v1.28.0) Updates `golang.org/x/net` from 0.53.0 to 0.54.0 - [Commits](https://github.com/golang/net/compare/v0.53.0...v0.54.0) Updates `github.com/pires/go-proxyproto` from 0.11.0 to 0.12.0 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](https://github.com/pires/go-proxyproto/compare/v0.11.0...v0.12.0) --- updated-dependencies: - dependency-name: github.com/alecthomas/chroma/v2 dependency-version: 2.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates - dependency-name: github.com/google/cel-go dependency-version: 0.28.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-updates - dependency-name: github.com/klauspost/compress dependency-version: 1.18.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-updates - dependency-name: go.opentelemetry.io/contrib/exporters/autoexport dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates - dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-version: 0.68.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates - dependency-name: go.uber.org/zap dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates - dependency-name: golang.org/x/net dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Zen Dodd <mail@steadytao.com>	2026-05-20 12:17:10 -06:00
Zen Dodd	9505c0baa0	caddytls: match IDN SNI in connection policies (#7742)	2026-05-20 13:52:28 -04:00
WeidiDeng	ad912569b5	reverseproxy: wraps request body to prevent closing if not read (#7719) ... Co-authored-by: Matt Holt <mholt@users.noreply.github.com>	2026-05-20 17:35:40 +00:00
Zen Dodd	6a210e96ee	caddyfile: preserve implicit TLS issuer semantics (#7743)	2026-05-20 12:48:37 -04:00
Zen Dodd	6628c4a9de	cmd: support caddy start on IPv6-only hosts (#7744)	2026-05-20 10:17:34 -04:00
Zen Dodd	408d20a0e5	caddyauth: add candidate placeholders for rejected identities (#7698)	2026-05-20 13:51:54 +00:00
Eyüp Can Akman	0b265eb845	reverseproxy: Add regression test for DialInfo network override (#7758)	2026-05-20 09:43:58 -04:00
Zen Dodd	88037f1666	chore: clean up wording and typo fixes (#7745) ... * chore: clean up wording and typo fixes * chore: ASCII -> alphanumeric in lexer for heredoc marker	2026-05-20 16:36:30 +10:00
cbro	325c244ea7	caddytls: fix TLS state races and ECH rotation retry (#7756) ... * caddytls: fix data race in session ticket key rotation stayUpdated copies the map header (configs := s.configs) under the lock, then iterates the original map after releasing it. Concurrent calls to register/unregister mutate the same map. Hold the lock for the entire iteration instead. * caddytls: fix data race in AllMatchingCertificates AllMatchingCertificates reads the package-level certCache without acquiring certCacheMu, while Cleanup sets certCache to nil under the write lock. The adjacent HasCertificateForSubject correctly acquires certCacheMu.RLock. Add the missing RLock/RUnlock to match. * caddytls: fix ECH key rotation stopping permanently on error When rotateECHKeys returns an error, the rotation goroutine returns immediately, stopping all future key rotation for the lifetime of the process. Change return to continue, matching the error handling for publishECHConfigs two lines below.	2026-05-20 16:35:40 +10:00
Brett Bethke	0125ae39cc	caddyhttp: omit Last-Modified for unusable mod times (#7740) ... See #5548 and #7730	2026-05-20 16:19:11 +10:00
Mohammed Al Sahaf	704394d9d1	chore: deps upgrade (#7751) ... Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>	2026-05-20 02:42:19 +03:00
Matt Holt	6c675e29f8	caddytls: Fix client auth (fix #7724) (#7727) ... The peer certificates should be loaded even if existingVerifyPeerCert is nil. Patched with the assistance of Copilot, as an experiment.	2026-05-14 10:05:57 -06:00
James Hartig	77e9ce7404	reverseproxy: further prevent body closes from dial errors (#7715)	2026-05-12 12:05:50 -06:00
Matthew Holt	cc58caa109	go.mod: Upgrade quic-go to v0.59.1	2026-05-11 17:33:42 -06:00
Br1an	d80774cb3f	metrics: Add nil check for metricsHandler in AdminMetrics.serveHTTP (#7553) ... * metrics: Add nil check for metricsHandler in AdminMetrics.serveHTTP Prevents panic when the admin metrics endpoint is accessed before the module is fully provisioned. Returns a proper API error instead of crashing. * admin: provision router modules before registering routes Instead of adding a nil check for metricsHandler, address the root cause by provisioning admin router modules before calling Routes(). This ensures all handler state is initialized before routes are registered on the mux. Merge newAdminHandler and provisionAdminRouters into a single step, removing the two-phase setup where routes were registered first and modules provisioned later. The AdminConfig.routers field is no longer needed since provisioning happens inline. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: go fmt admin.go --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-05-11 17:27:03 -06:00
Rayan Salhab	a4a38c3e88	rewrite: escape file matcher paths before rewriting (#7683) ... * fix: escape file matcher paths in rewrites Preserve matched file paths containing literal '?' or '%' when try_files rewrites to http.matchers.file.relative. * test: cover nested escaped try_files rewrite paths * test: cover encoded slash try_files rewrite paths * fix: assert file matcher placeholder as string --------- Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com>	2026-05-11 17:16:33 -06:00
Matthew Holt	761347aa63	templates: Explicitly warn about misconfigurations	2026-05-11 16:45:49 -06:00
Steffen Busch	4ba16fe82c	docs: add documentation for fileExists and fileStat template functions (#7700)	2026-05-12 04:23:58 +10:00
Rijul	0fab9f0f7d	caddytls: avoid duplicate automation for wildcard-covered hosts (#7697) ... * caddytls: Fix wildcard race in auto-HTTPS launch When evaluating whether to skip managing an individual subdomain due to an existing wildcard configuration, we now explicitly consult the automate loader. Because Caddy apps can start in any order, relying strictly on the TLS app's internal management state was non-deterministic if the HTTP app started first. Checking the automate loader guarantees predictable behavior since it is fully populated during the Provision phase, well before any apps are started. * respond to review comments 1. update requested comment 2. remove personal domain from test 3. add regression test * remove unnecessary mutex lock * refactor: -integration test, +explicit cases * refactor: remove redundant test, add comment * rename file and add header * update copyright year	2026-05-11 00:08:40 +10:00
Zen Dodd	5e76b5ee43	tls: add alpn to managed HTTPS records (#7653) ... * tls: add alpn to managed HTTPS records * tls: centralise HTTPS RR ALPN defaults and registration Reuse shared protocol defaults instead of repeating the default HTTP protocol list, unify server name registration to carry ALPN in one experimental API and reuse the TLS default ALPN ordering for HTTPS RR publication * http: centralise effective protocol resolution for HTTPS RR ALPN	2026-05-10 13:10:29 +10:00
Matthew Holt	9c78b97f9e	fastcgi: Fix lint	2026-05-08 10:46:28 -06:00
Kévin Dunglas	fb324331f4	Merge commit from fork ... Both fallbacks in splitPos relied on golang.org/x/text/search with search.IgnoreCase, which performs Unicode equivalence matching far beyond ASCII case folding. Combined with the validated-ASCII guarantee on every SplitPath entry, that fallback turned non-PHP filenames into PHP scripts: - when the inner loop hit a non-ASCII byte and the IndexString fallback returned -1, the loop broke without resetting match=false, so a stale match=true caused a non-existent .php to be reported (PoC: "/name.<U+00A1>.txt"). - search.IgnoreCase folded fullwidth, mathematical and circled letters onto ASCII, so "/shell.<math sans-serif php>", "/shell.<fullwidth p>hp", "/shell.<circled php>" were all detected as ".php" files. Replace the fallback with strict byte-level ASCII case-insensitive matching: any byte >= utf8.RuneSelf in the path can never be part of a match, since SplitPath entries are validated ASCII-only and lower-cased in Provision(). This keeps the hot path branch-light and removes the x/text/search dependency from the main module. Reported against FrankenPHP as GHSA-3g8v-8r37-cgjm and GHSA-v4h7-cj44-8fc8. The vulnerable function in this module was adapted from the same FrankenPHP code.	2026-05-07 13:59:42 -06:00
tomholford	0780d4489c	httpcaddyfile: accept duration strings for log sampling interval (#7694) ... Co-authored-by: tomholford <tomholford@users.noreply.github.com>	2026-05-07 18:32:20 +00:00
Zen Dodd	d2172bea61	chore: Fix golangci-lint 2.12.1 findings (#7690)	2026-05-07 03:40:26 -04:00