@marcel91200 / caddy Mirror · read-only / commits / 53c4d788
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 13, 16:45 UTC

headers: Only replace known placeholders (#4880)

Francis Lavoie committed Jul 12, 2022 at 14:16 UTC 53c4d788d4bbc00d396be743a2c0b36482e53c6e
1 file changed +10 -10
modules/caddyhttp/headers/headers.go
+10 -10
@@ -194,27 +194,27 @@ type RespHeaderOps struct {
194 func (ops HeaderOps) ApplyTo(hdr http.Header, repl *caddy.Replacer) {
195 // add
196 for fieldName, vals := range ops.Add {
197 - fieldName = repl.ReplaceAll(fieldName, "")
197 + fieldName = repl.ReplaceKnown(fieldName, "")
198 for _, v := range vals {
199 - hdr.Add(fieldName, repl.ReplaceAll(v, ""))
199 + hdr.Add(fieldName, repl.ReplaceKnown(v, ""))
200 }
201 }
202
203 // set
204 for fieldName, vals := range ops.Set {
205 - fieldName = repl.ReplaceAll(fieldName, "")
205 + fieldName = repl.ReplaceKnown(fieldName, "")
206 var newVals []string
207 for i := range vals {
208 // append to new slice so we don't overwrite
209 // the original values in ops.Set
210 - newVals = append(newVals, repl.ReplaceAll(vals[i], ""))
210 + newVals = append(newVals, repl.ReplaceKnown(vals[i], ""))
211 }
212 hdr.Set(fieldName, strings.Join(newVals, ","))
213 }
214
215 // delete
216 for _, fieldName := range ops.Delete {
217 - fieldName = strings.ToLower(repl.ReplaceAll(fieldName, ""))
217 + fieldName = strings.ToLower(repl.ReplaceKnown(fieldName, ""))
218 switch {
219 case strings.HasPrefix(fieldName, "*") && strings.HasSuffix(fieldName, "*"):
220 for existingField := range hdr {
@@ -241,13 +241,13 @@ func (ops HeaderOps) ApplyTo(hdr http.Header, repl *caddy.Replacer) {
241
242 // replace
243 for fieldName, replacements := range ops.Replace {
244 - fieldName = http.CanonicalHeaderKey(repl.ReplaceAll(fieldName, ""))
244 + fieldName = http.CanonicalHeaderKey(repl.ReplaceKnown(fieldName, ""))
245
246 // all fields...
247 if fieldName == "*" {
248 for _, r := range replacements {
249 - search := repl.ReplaceAll(r.Search, "")
250 - replace := repl.ReplaceAll(r.Replace, "")
249 + search := repl.ReplaceKnown(r.Search, "")
250 + replace := repl.ReplaceKnown(r.Replace, "")
251 for fieldName, vals := range hdr {
252 for i := range vals {
253 if r.re != nil {
@@ -263,8 +263,8 @@ func (ops HeaderOps) ApplyTo(hdr http.Header, repl *caddy.Replacer) {
263
264 // ...or only with the named field
265 for _, r := range replacements {
266 - search := repl.ReplaceAll(r.Search, "")
267 - replace := repl.ReplaceAll(r.Replace, "")
266 + search := repl.ReplaceKnown(r.Search, "")
267 + replace := repl.ReplaceKnown(r.Replace, "")
268 for hdrFieldName, vals := range hdr {
269 // see issue #4330 for why we don't simply use hdr[fieldName]
270 if http.CanonicalHeaderKey(hdrFieldName) != fieldName {