mirror of
https://github.com/caddyserver/caddy.git
synced 2026-07-31 09:27:54 -04:00
c6180a0852
* caddyhttp: normalize Windows path in path_regexp matcher, shared with path matcher Apply the same Windows path normalization to MatchPathRE that MatchPath already had, and factor it into a shared normalizeWindowsPath helper so both matchers use one implementation. Also strip trailing dots and spaces per path component (not only at the end of the whole path), matching how Windows resolves paths; this fixes the same gap in the path matcher too. Adds regression tests for both matchers. See #5613. * caddyhttp: normalize trailing dots/spaces in escaped-path branch too The MatchPath escaped-path branch (taken when a matcher pattern contains '%') only folded backslash separators via windowsEscapedPathSeparatorRepl; it skipped the per-component trailing dot/space normalization now applied on the decoded branch. On Windows this left a bypass: a matcher such as `path /private%2f*` could be evaded by GET /private.%5csecret.txt, since `private.` and `private` resolve to the same directory on NTFS. Add normalizeWindowsEscapedPath, which trims trailing dots and spaces — literal ("." / " ") and percent-encoded ("%2e" / "%20") — from every component in raw/escaped space, splitting on both '/' and encoded '%2f' separators while preserving them, and leaving "." / ".." for CleanPath. Regression tests cover the literal and percent-encoded variants against a '%'-containing matcher. --------- Co-authored-by: thientd <thien.taduc@ninhthanh.com>