caddyhttp: Fix `MatchPath` sanitizing (#4499)

This is a followup to #4407, in response to a report on the forums: https://caddy.community/t/php-fastcgi-phishing-redirection/14542 Turns out that doing `TrimRight` to remove trailing dots, _before_ cleaning the path, will cause double-dots at the end of the path to not be cleaned away as they should. We should instead remove the dots _after_ cleaning.

Francis Lavoie committed Dec 30, 2021 at 04:15 UTC 3fe2c73dd04f7769a9d9673236cb94b79ac45659

1 file changed +5 -5

modules/caddyhttp/matchers.go

+5 -5

@@ -325,6 +325,11 @@ func (m MatchPath) Match(r *http.Request) bool {

325

326 lowerPath := strings.ToLower(unescapedPath)

327

328 + // Clean the path, merges doubled slashes, etc.

329 + // This ensures maliciously crafted requests can't bypass

330 + // the path matcher. See #4407

331 + lowerPath = path.Clean(lowerPath)

332 +

333 // see #2917; Windows ignores trailing dots and spaces

334 // when accessing files (sigh), potentially causing a

335 // security risk (cry) if PHP files end up being served

@@ -332,11 +337,6 @@ func (m MatchPath) Match(r *http.Request) bool {

337 // being matched by *.php to be treated as PHP scripts

338 lowerPath = strings.TrimRight(lowerPath, ". ")

339

335 - // Clean the path, merges doubled slashes, etc.

336 - // This ensures maliciously crafted requests can't bypass

337 - // the path matcher. See #4407

338 - lowerPath = path.Clean(lowerPath)

339 -

340 // Cleaning may remove the trailing slash, but we want to keep it

341 if lowerPath != "/" && strings.HasSuffix(r.URL.Path, "/") {

342 lowerPath = lowerPath + "/"