fileserver: Preserve query during canonicalization redirect (#6109)

* fileserver: Preserve query during canonicalization redirect * Clarify that only a path should be passed

Francis Lavoie committed Mar 6, 2024 at 00:51 UTC 5a4374bea055c49c9c38b6a7d41e43742c137341

1 file changed +10 -4

modules/caddyhttp/fileserver/staticfiles.go

+10 -4

@@ -639,12 +639,18 @@ func calculateEtag(d os.FileInfo) string {

639 return `"` + t + s + `"`

640 }

641

642 -func redirect(w http.ResponseWriter, r *http.Request, to string) error {

643 - for strings.HasPrefix(to, "//") {

642 +// redirect performs a redirect to a given path. The 'toPath' parameter

643 +// MUST be solely a path, and MUST NOT include a query.

644 +func redirect(w http.ResponseWriter, r *http.Request, toPath string) error {

645 + for strings.HasPrefix(toPath, "//") {

646 // prevent path-based open redirects

645 - to = strings.TrimPrefix(to, "/")

647 + toPath = strings.TrimPrefix(toPath, "/")

648 }

647 - http.Redirect(w, r, to, http.StatusPermanentRedirect)

649 + // preserve the query string if present

650 + if r.URL.RawQuery != "" {

651 + toPath += "?" + r.URL.RawQuery

652 + }

653 + http.Redirect(w, r, toPath, http.StatusPermanentRedirect)

654 return nil

655 }

656