Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 00:30 UTC
caddyfile: check that matched key is not a substring of the replacement key (#5685)
WeidiDeng committed
Aug 5, 2023 at 00:44 UTC
9f34383c02f1691e54280285a6499893fcbbb4c7
2 files changed
+40
caddyconfig/caddyfile/importargs.go
+10
@@ -93,6 +93,11 @@ func makeArgsReplacer(args []string) *caddy.Replacer {
93
// TODO: Remove the deprecated {args.*} placeholder
94
// support at some point in the future
95
if matches := argsRegexpIndexDeprecated.FindStringSubmatch(key); len(matches) > 0 {
96
+ // What's matched may be a substring of the key
97
+ if matches[0] != key {
98
+ return nil, false
99
+ }
100
+
101
value, err := strconv.Atoi(matches[1])
102
if err != nil {
103
caddy.Log().Named("caddyfile").Warn(
@@ -111,6 +116,11 @@ func makeArgsReplacer(args []string) *caddy.Replacer {
116
117
// Handle args[*] form
118
if matches := argsRegexpIndex.FindStringSubmatch(key); len(matches) > 0 {
119
+ // What's matched may be a substring of the key
120
+ if matches[0] != key {
121
+ return nil, false
122
+ }
123
+
124
if strings.Contains(matches[1], ":") {
125
caddy.Log().Named("caddyfile").Warn(
126
"Variadic placeholder {args[" + matches[1] + "]} must be a token on its own")
caddyconfig/caddyfile/parse_test.go
+30
@@ -718,6 +718,36 @@ func TestEnvironmentReplacement(t *testing.T) {
718
}
719
}
720
721
+func TestImportReplacementInJSONWithBrace(t *testing.T) {
722
+ for i, test := range []struct {
723
+ args []string
724
+ input string
725
+ expect string
726
+ }{
727
+ {
728
+ args: []string{"123"},
729
+ input: "{args[0]}",
730
+ expect: "123",
731
+ },
732
+ {
733
+ args: []string{"123"},
734
+ input: `{"key":"{args[0]}"}`,
735
+ expect: `{"key":"123"}`,
736
+ },
737
+ {
738
+ args: []string{"123", "123"},
739
+ input: `{"key":[{args[0]},{args[1]}]}`,
740
+ expect: `{"key":[123,123]}`,
741
+ },
742
+ } {
743
+ repl := makeArgsReplacer(test.args)
744
+ actual := repl.ReplaceKnown(test.input, "")
745
+ if actual != test.expect {
746
+ t.Errorf("Test %d: Expected: '%s' but got '%s'", i, test.expect, actual)
747
+ }
748
+ }
749
+}
750
+
751
func TestSnippets(t *testing.T) {
752
p := testParser(`
753
(common) {