fastcgi: Ensure leading slash, omit SERVER_PORT if empty for compliance (#3570)

See https://tools.ietf.org/html/rfc3875#section-4.1.13 for SCRIPT_NAME requiring leading slash See https://tools.ietf.org/html/rfc3875#section-4.1.15 for SERVER_PORT requiring omission if empty

Francis Lavoie committed Jul 17, 2020 at 16:48 UTC 0665a86eb72a178a42741d477b765169d7423fd8

1 file changed +13 -1

modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go

+13 -1

@@ -202,6 +202,12 @@ func (t Transport) buildEnv(r *http.Request) (map[string]string, error) {

202 pathPrefix, _ := r.Context().Value(caddy.CtxKey("path_prefix")).(string)

203 scriptName = path.Join(pathPrefix, scriptName)

204

205 + // Ensure the SCRIPT_NAME has a leading slash for compliance with RFC3875

206 + // Info: https://tools.ietf.org/html/rfc3875#section-4.1.13

207 + if scriptName != "" && !strings.HasPrefix(scriptName, "/") {

208 + scriptName = "/" + scriptName

209 + }

210 +

211 // Get the request URL from context. The context stores the original URL in case

212 // it was changed by a middleware such as rewrite. By default, we pass the

213 // original URI in as the value of REQUEST_URI (the user can overwrite this

@@ -249,7 +255,6 @@ func (t Transport) buildEnv(r *http.Request) (map[string]string, error) {

255 "REQUEST_METHOD": r.Method,

256 "REQUEST_SCHEME": requestScheme,

257 "SERVER_NAME": reqHost,

252 - "SERVER_PORT": reqPort,

258 "SERVER_PROTOCOL": r.Proto,

259 "SERVER_SOFTWARE": t.serverSoftware,

260

@@ -269,6 +274,13 @@ func (t Transport) buildEnv(r *http.Request) (map[string]string, error) {

274 env["PATH_TRANSLATED"] = filepath.Join(root, pathInfo) // Info: http://www.oreilly.com/openbook/cgi/ch02_04.html

275 }

276

277 + // compliance with the CGI specification requires that

278 + // SERVER_PORT should only exist if it's a valid numeric value.

279 + // Info: https://www.ietf.org/rfc/rfc3875 Page 18

280 + if reqPort != "" {

281 + env["SERVER_PORT"] = reqPort

282 + }

283 +

284 // Some web apps rely on knowing HTTPS or not

285 if r.TLS != nil {

286 env["HTTPS"] = "on"