Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 21:45 UTC
fastcgi: Protect against requests with null bytes in the path (#4614)
Francis Lavoie committed
Mar 7, 2022 at 12:06 UTC
c8f2834b514f8bfb405c11be53d60a6cfc5228ca
1 file changed
+7
modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
+7
@@ -110,6 +110,13 @@ func (t *Transport) Provision(ctx caddy.Context) error {
110
111
// RoundTrip implements http.RoundTripper.
112
func (t Transport) RoundTrip(r *http.Request) (*http.Response, error) {
113
+ // Disallow null bytes in the request path, because
114
+ // PHP upstreams may do bad things, like execute a
115
+ // non-PHP file as PHP code. See #4574
116
+ if strings.Contains(r.URL.Path, "\x00") {
117
+ return nil, caddyhttp.Error(http.StatusBadRequest, fmt.Errorf("invalid request path"))
118
+ }
119
+
120
env, err := t.buildEnv(r)
121
if err != nil {
122
return nil, fmt.Errorf("building environment: %v", err)