mirror/caddy
1
0
Fork 0
mirror of https://github.com/caddyserver/caddy.git synced 2026-06-10 16:58:04 -04:00
Code Issues Packages Projects Releases Wiki Activity

admin: fix origin comparison

Browse Source 
Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com>
This commit is contained in:
Mohammed Al Sahaf
2026-06-09 02:29:52 +03:00
parent c67ace9949
commit 1661cfd901
2 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
admin.go
View File

@@ -978,7 +978,9 @@ func (h adminHandler) originAllowed(origin *url.URL) bool {
if allowedOrigin.Scheme != "" && origin.Scheme != allowedOrigin.Scheme {
continue
}
if origin.Host == allowedOrigin.Host {
// Host comparison is case-insensitive per RFC 3986 §3.2.2; url.Parse
// does not normalize host case, so fold it here.
if strings.EqualFold(origin.Host, allowedOrigin.Host) {
return true
}
}

16
admin_security_test.go
View File

@@ -90,12 +90,24 @@ func TestAdminHandlerOriginAllowed(t *testing.T) {
want: true,
},
{
// Per RFC 3986 section 3.2.2, host names are case-insensitive.
name: "case-sensitive host comparison (potential RFC 3986 deviation)",
// Per RFC 3986 §3.2.2, host names are case-insensitive.
name: "host comparison is case-insensitive (allow-list uppercase)",
allowedOrigins: []*url.URL{mustParseURL(t, "http://Example.com:8080")},
origin: mustParseURL(t, "http://example.com:8080"),
want: true,
},
{
name: "host comparison is case-insensitive (origin uppercase)",
allowedOrigins: []*url.URL{mustParseURL(t, "http://example.com:8080")},
origin: mustParseURL(t, "http://EXAMPLE.com:8080"),
want: true,
},
{
name: "host comparison is case-insensitive (mixed case)",
allowedOrigins: []*url.URL{mustParseURL(t, "http://Foo.Bar.Example.com:8080")},
origin: mustParseURL(t, "http://foo.bar.example.COM:8080"),
want: true,
},
}
for _, tc := range tests {