caddy

mirror/caddy

0 Fork 0

mirror of https://github.com/caddyserver/caddy.git synced 2026-09-15 15:17:25 -04:00

Files

T

Kévin Dunglas 947087cadd Merge commit from fork

Caddy's underscore header filter (GHSA-f59h-q822-g45g) only checked
for `_`. PHP folds `.` to `_` when registering $_SERVER keys the same
way CGI/FastCGI folds `-` to `_`, so a dotted alias (e.g. Remote.User)
survived the filter and collided with the legitimate hyphenated
header once it reached a PHP/FastCGI backend, bypassing forward_auth
copy_headers the same way the underscore alias did.

Extends the filter to drop `.` symmetrically, adds an
`expected_dot_headers` allowlist mirroring `expected_underscore_headers`,
and handles header names containing both separators (only an exact
allowlist entry is honored there, since a prefix glob's free-form
suffix can't be vetted for an embedded second separator).

Root cause identified by @iliaal in the FrankenPHP advisory
GHSA-49wc-4hcv-v58q.

2026-08-11 08:00:15 -06:00

caddyfile.go

Use slices.Contains to simplify code (#7039 )

2025-05-31 12:03:06 -06:00

client_test.go

use math/rand/v2 instead of math/rand (#7413 )

2026-02-11 09:15:51 -07:00

client.go

chore: clean up wording and typo fixes (#7745 )

2026-05-20 16:36:30 +10:00

fastcgi_test.go

Merge commit from fork