Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 23:30 UTC
fileserver: map invalid path errors to fs.ErrInvalid, and return 400 for any invalid path errors. (close #7008) (#7017)
Jimmy Lipham committed
May 13, 2025 at 08:43 UTC
94147caf31f7e56a919432accc2779a22b2ed1a0
1 file changed
+8
-1
modules/caddyhttp/fileserver/staticfiles.go
+8
-1
@@ -300,8 +300,10 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request, next c
300
info, err := fs.Stat(fileSystem, filename)
301
if err != nil {
302
err = fsrv.mapDirOpenError(fileSystem, err, filename)
303
- if errors.Is(err, fs.ErrNotExist) || errors.Is(err, fs.ErrInvalid) {
303
+ if errors.Is(err, fs.ErrNotExist) {
304
return fsrv.notFound(w, r, next)
305
+ } else if errors.Is(err, fs.ErrInvalid) {
306
+ return caddyhttp.Error(http.StatusBadRequest, err)
307
} else if errors.Is(err, fs.ErrPermission) {
308
return caddyhttp.Error(http.StatusForbidden, err)
309
}
@@ -611,6 +613,11 @@ func (fsrv *FileServer) mapDirOpenError(fileSystem fs.FS, originalErr error, nam
613
return originalErr
614
}
615
616
+ var pathErr *fs.PathError
617
+ if errors.As(originalErr, &pathErr) {
618
+ return fs.ErrInvalid
619
+ }
620
+
621
parts := strings.Split(name, separator)
622
for i := range parts {
623
if parts[i] == "" {