@marcel91200 / caddy Mirror · read-only / commits / 54937914
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 11, 04:45 UTC

caddyhttp: fix randString sameCase dictionary to match its docs (#7972)

* caddyhttp: fix randString sameCase dictionary to match its docs The doc comment says randString excludes confusing characters like I, l, 1, 0, O. When sameCase is true, uppercase letters and the characters l and o should be excluded. But the sameCase dictionary still contained '0'. Drop it. Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * Update modules/caddyhttp/errors.go Signed-off-by: Matt Holt <mholt@users.noreply.github.com> * elaborate the doc, and expand tests Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> * Update modules/caddyhttp/errors_randstring_test.go Co-authored-by: Zen Dodd <mail@steadytao.com> Signed-off-by: Mohammed Al Sahaf <mohammed@caffeinatedwonders.com> --------- Signed-off-by: Mohammed Al Sahaf <msaa1990@gmail.com> Signed-off-by: Matt Holt <mholt@users.noreply.github.com> Signed-off-by: Mohammed Al Sahaf <mohammed@caffeinatedwonders.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Zen Dodd <mail@steadytao.com>

Mohammed Al Sahaf committed Sep 25, 2026 at 19:01 UTC 54937914234be0911a9d22a8d1f5560c1ca59fd2
2 files changed +78 -3
modules/caddyhttp/errors.go
+5 -3
@@ -85,15 +85,17 @@ func (e HandlerError) Unwrap() error { return e.Err }
85 // randString returns a string of n random characters.
86 // It is not even remotely secure OR a proper distribution.
87 // But it's good enough for some things. It excludes certain
88 -// confusing characters like I, l, 1, 0, O, etc. If sameCase
89 -// is true, then uppercase letters are excluded.
88 +// confusing characters.
89 +// If sameCase is false, then l, I, O, S, 1, and 0 are excluded.
90 +// If sameCase is true, then uppercase letters are excluded in
91 +// addition to l, o, 1, and 0.
92 func randString(n int, sameCase bool) string {
93 if n <= 0 {
94 return ""
95 }
96 dict := []byte("abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRTUVWXY23456789")
97 if sameCase {
96 - dict = []byte("abcdefghijkmnpqrstuvwxyz0123456789")
98 + dict = []byte("abcdefghijkmnpqrstuvwxyz23456789")
99 }
100 b := make([]byte, n)
101 for i := range b {
modules/caddyhttp/errors_randstring_test.go new
+73
@@ -0,0 +1,73 @@
1 +// Copyright 2015 Matthew Holt and The Caddy Authors
2 +//
3 +// Licensed under the Apache License, Version 2.0 (the "License");
4 +// you may not use this file except in compliance with the License.
5 +// You may obtain a copy of the License at
6 +//
7 +// http://www.apache.org/licenses/LICENSE-2.0
8 +//
9 +// Unless required by applicable law or agreed to in writing, software
10 +// distributed under the License is distributed on an "AS IS" BASIS,
11 +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 +// See the License for the specific language governing permissions and
13 +// limitations under the License.
14 +
15 +package caddyhttp
16 +
17 +import (
18 + "strings"
19 + "testing"
20 +)
21 +
22 +// TestRandString_NotSameCaseExcludedChars is the regression test for the
23 +// randString(sameCase=false) dictionary bug where excluded was still emitted
24 +// despite being called out as a confusing character in the doc comment.
25 +func TestRandString_NotSameCaseExcludedChars(t *testing.T) {
26 + // A sample of 5000 characters makes a leaked excluded character extremely unlikely
27 + // to go unnoticed: the dictionary is 55 characters, so the expected
28 + // count for any single character would be ~90 if it were present.
29 + s := randString(5000, false)
30 + if strings.ContainsRune(s, 'l') {
31 + t.Errorf("randString(n, sameCase=false) must not emit 'l'; got %q", s)
32 + }
33 + if strings.ContainsRune(s, 'I') {
34 + t.Errorf("randString(n, sameCase=false) must not emit 'I'; got %q", s)
35 + }
36 + if strings.ContainsRune(s, 'O') {
37 + t.Errorf("randString(n, sameCase=false) must not emit 'O'; got %q", s)
38 + }
39 + if strings.ContainsRune(s, 'S') {
40 + t.Errorf("randString(n, sameCase=false) must not emit 'S'; got %q", s)
41 + }
42 + if strings.ContainsRune(s, '0') {
43 + t.Errorf("randString(n, sameCase=false) must not emit '0'; got %q", s)
44 + }
45 + if strings.ContainsRune(s, '1') {
46 + t.Errorf("randString(n, sameCase=false) must not emit '1'; got %q", s)
47 + }
48 +}
49 +
50 +// TestRandString_SameCaseExcludedChars is the regression test for the
51 +// randString(sameCase=true) dictionary bug where excluded was still emitted
52 +// despite being called out as a confusing character in the doc comment.
53 +func TestRandString_SameCaseExcludedChars(t *testing.T) {
54 + // A sample of 5000 characters makes a leaked excluded character extremely unlikely
55 + // to go unnoticed: the dictionary is 32 characters, so the expected
56 + // count for any single character would be ~156 if it were present.
57 + s := randString(5000, true)
58 + if strings.ToLower(s) != s {
59 + t.Errorf("randString(n, sameCase=true) must not emit uppercase letters; got %q", s)
60 + }
61 + if strings.ContainsRune(s, 'l') {
62 + t.Errorf("randString(n, sameCase=true) must not emit 'l'; got %q", s)
63 + }
64 + if strings.ContainsRune(s, 'o') {
65 + t.Errorf("randString(n, sameCase=true) must not emit 'o': got %q", s)
66 + }
67 + if strings.ContainsRune(s, '0') {
68 + t.Errorf("randString(n, sameCase=true) must not emit '0'; got %q", s)
69 + }
70 + if strings.ContainsRune(s, '1') {
71 + t.Errorf("randString(n, sameCase=true) must not emit '1'; got %q", s)
72 + }
73 +}