reverseproxy: validate versions in http transport (#7112)

WeidiDeng committed Jul 10, 2025 at 04:13 UTC 1209b5c5669fc5d0a708931f138bfa7a5d4c5ebc

1 file changed +13

modules/caddyhttp/reverseproxy/httptransport.go

+13

@@ -171,12 +171,25 @@ func (HTTPTransport) CaddyModule() caddy.ModuleInfo {

171 }

172 }

173

174 +var (

175 + allowedVersions = []string{"1.1", "2", "h2c", "3"}

176 + allowedVersionsString = strings.Join(allowedVersions, ", ")

177 +)

178 +

179 // Provision sets up h.Transport with a *http.Transport

180 // that is ready to use.

181 func (h *HTTPTransport) Provision(ctx caddy.Context) error {

182 if len(h.Versions) == 0 {

183 h.Versions = []string{"1.1", "2"}

184 }

185 + // some users may provide http versions not recognized by caddy, instead of trying to

186 + // guess the version, we just error out and let the user fix their config

187 + // see: https://github.com/caddyserver/caddy/issues/7111

188 + for _, v := range h.Versions {

189 + if !slices.Contains(allowedVersions, v) {

190 + return fmt.Errorf("unsupported HTTP version: %s, supported version: %s", v, allowedVersionsString)

191 + }

192 + }

193

194 rt, err := h.NewTransport(ctx)

195 if err != nil {