Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 01:00 UTC
caddyfile: reject negative import argument indices (#8316)
{args[-1]} and {args.-1} parsed as -1 and indexed the args slice directly, panicking with index out of range. Treat negative indices as out of bounds, like indices past the end.
D'Ali Ben Macha committed
Nov 3, 2026 at 09:15 UTC
482f867395cf2f58148cbee7993dd7edd0750edb
2 files changed
+42
-2
caddyconfig/caddyfile/importargs.go
+2
-2
@@ -112,7 +112,7 @@ func makeArgsReplacer(args []string) *caddy.Replacer {
112
"Placeholder {args." + matches[1] + "} has an invalid index")
113
return nil, false
114
}
115
- if value >= len(args) {
115
+ if value < 0 || value >= len(args) {
116
caddy.Log().Named("caddyfile").Warn(
117
"Placeholder {args." + matches[1] + "} index is out of bounds, only " + strconv.Itoa(len(args)) + " argument(s) exist")
118
return nil, false
@@ -140,7 +140,7 @@ func makeArgsReplacer(args []string) *caddy.Replacer {
140
"Placeholder {args[" + matches[1] + "]} has an invalid index")
141
return nil, false
142
}
143
- if value >= len(args) {
143
+ if value < 0 || value >= len(args) {
144
caddy.Log().Named("caddyfile").Warn(
145
"Placeholder {args[" + matches[1] + "]} index is out of bounds, only " + strconv.Itoa(len(args)) + " argument(s) exist")
146
return nil, false
caddyconfig/caddyfile/parse_test.go
+40
@@ -809,6 +809,46 @@ func TestImportReplacementInJSONWithBrace(t *testing.T) {
809
}
810
}
811
812
+func TestArgsReplacerOutOfBoundsIndex(t *testing.T) {
813
+ for i, test := range []struct {
814
+ args []string
815
+ input string
816
+ expect string
817
+ }{
818
+ {
819
+ args: []string{"a", "b"},
820
+ input: "{args[1]}",
821
+ expect: "b",
822
+ },
823
+ {
824
+ args: []string{"a", "b"},
825
+ input: "{args[2]}",
826
+ expect: "{args[2]}",
827
+ },
828
+ {
829
+ args: []string{"a", "b"},
830
+ input: "{args[-1]}",
831
+ expect: "{args[-1]}",
832
+ },
833
+ {
834
+ args: []string{"a", "b"},
835
+ input: "{args.-1}",
836
+ expect: "{args.-1}",
837
+ },
838
+ {
839
+ args: nil,
840
+ input: "{args[-1]}",
841
+ expect: "{args[-1]}",
842
+ },
843
+ } {
844
+ repl := makeArgsReplacer(test.args)
845
+ actual := repl.ReplaceKnown(test.input, "")
846
+ if actual != test.expect {
847
+ t.Errorf("Test %d: Expected: '%s' but got '%s'", i, test.expect, actual)
848
+ }
849
+ }
850
+}
851
+
852
func TestSnippets(t *testing.T) {
853
p := testParser(`
854
(common) {