Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 13:30 UTC
vars: Don't expand placeholders in values (#7629)
vnxme committed
Apr 10, 2026 at 18:37 UTC
5de1565ff6182fbb191b5a2d3949b977ed536d57
1 file changed
+10
-22
modules/caddyhttp/vars.go
+10
-22
@@ -181,18 +181,15 @@ func (m VarsMatcher) MatchWithError(r *http.Request) (bool, error) {
181
vars := r.Context().Value(VarsCtxKey).(map[string]any)
182
repl := r.Context().Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
183
184
- var fromPlaceholder bool
185
- var matcherValExpanded, valExpanded, varStr, v string
184
+ var matcherValExpanded, varStr, v string
185
var varValue any
186
for key, vals := range m {
187
if strings.HasPrefix(key, "{") &&
188
strings.HasSuffix(key, "}") &&
189
strings.Count(key, "{") == 1 {
190
varValue, _ = repl.Get(strings.Trim(key, "{}"))
192
- fromPlaceholder = true
191
} else {
192
varValue = vars[key]
195
- fromPlaceholder = false
193
}
194
195
switch vv := varValue.(type) {
@@ -208,19 +205,15 @@ func (m VarsMatcher) MatchWithError(r *http.Request) (bool, error) {
205
varStr = fmt.Sprintf("%v", vv)
206
}
207
211
- // Only expand placeholders in values from literal variable names
212
- // (e.g. map outputs). Values resolved from placeholder keys are
208
+ // Don't expand placeholders in values from literal variable names
209
+ // (e.g. map outputs) or other placeholders. These values are
210
// already final and must not be re-expanded, as that would allow
211
// user input like {env.SECRET} to be evaluated.
215
- valExpanded = varStr
216
- if !fromPlaceholder {
217
- valExpanded = repl.ReplaceAll(varStr, "")
218
- }
212
213
// see if any of the values given in the matcher match the actual value
214
for _, v = range vals {
215
matcherValExpanded = repl.ReplaceAll(v, "")
223
- if valExpanded == matcherValExpanded {
216
+ if varStr == matcherValExpanded {
217
return true, nil
218
}
219
}
@@ -324,18 +317,16 @@ func (m MatchVarsRE) MatchWithError(r *http.Request) (bool, error) {
317
vars := r.Context().Value(VarsCtxKey).(map[string]any)
318
repl := r.Context().Value(caddy.ReplacerCtxKey).(*caddy.Replacer)
319
327
- var fromPlaceholder, match bool
328
- var valExpanded, varStr string
320
+ var match bool
321
+ var varStr string
322
var varValue any
323
for key, val := range m {
324
if strings.HasPrefix(key, "{") &&
325
strings.HasSuffix(key, "}") &&
326
strings.Count(key, "{") == 1 {
327
varValue, _ = repl.Get(strings.Trim(key, "{}"))
335
- fromPlaceholder = true
328
} else {
329
varValue = vars[key]
338
- fromPlaceholder = false
330
}
331
332
switch vv := varValue.(type) {
@@ -351,15 +342,12 @@ func (m MatchVarsRE) MatchWithError(r *http.Request) (bool, error) {
342
varStr = fmt.Sprintf("%v", vv)
343
}
344
354
- // Only expand placeholders in values from literal variable names
355
- // (e.g. map outputs). Values resolved from placeholder keys are
345
+ // Don't expand placeholders in values from literal variable names
346
+ // (e.g. map outputs) or other placeholders. These values are
347
// already final and must not be re-expanded, as that would allow
348
// user input like {env.SECRET} to be evaluated.
358
- valExpanded = varStr
359
- if !fromPlaceholder {
360
- valExpanded = repl.ReplaceAll(varStr, "")
361
- }
362
- if match = val.Match(valExpanded, repl); match {
349
+
350
+ if match = val.Match(varStr, repl); match {
351
return match, nil
352
}
353
}