Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 01:00 UTC
fileserver: only match a dir when the pattern ends by / (#8352)
Kévin Dunglas committed
Nov 4, 2026 at 16:45 UTC
b5d67d65400e723c4c4863624d3dffab1f34db57
2 files changed
+18
modules/caddyhttp/fileserver/matcher.go
+6
@@ -388,6 +388,12 @@ func (m MatchFile) selectFile(r *http.Request) (bool, error) {
388
}
389
beforeSplit, afterSplit := m.firstSplit(cleanedFile)
390
391
+ // only a pattern ending in "/" matches a directory, so with "{path}" a
392
+ // request for "/dir/" falls through to the next entry (e.g. "{path}/index.php")
393
+ if beforeSplit != "/" && strings.HasSuffix(beforeSplit, "/") && !strings.HasSuffix(file, "/") {
394
+ return nil
395
+ }
396
+
397
// create the full path to the file by prepending the site root
398
fullPattern := caddyhttp.SanitizedPathJoin(root, beforeSplit)
399
modules/caddyhttp/fileserver/matcher_test.go
+12
@@ -388,6 +388,18 @@ func TestPHPFileMatcher(t *testing.T) {
388
expectedType: "file",
389
matched: true,
390
},
391
+ {
392
+ path: "/foo.php.php/",
393
+ expectedPath: "/foo.php.php/index.php",
394
+ expectedType: "file",
395
+ matched: true,
396
+ },
397
+ {
398
+ path: "/foo.php.php/./",
399
+ expectedPath: "/foo.php.php/index.php",
400
+ expectedType: "file",
401
+ matched: true,
402
+ },
403
{
404
// See https://github.com/caddyserver/caddy/issues/3623
405
path: "/%E2%C3",