@marcel91200 / caddy Mirror · read-only / commits / f5c30940
Fork 0

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

Mirrored from https://github.com/Slazee/caddy.git

Synced Nov 11, 21:00 UTC

cmd: prevent commas in header values from being split (#7268)

`pflag.GetStringSlice` treats commas as delimiters, which causes issues when passing headers whose values contain commas (`X-Robots-Tag: noindex, nofollow`). These are incorrectly split into multiple headers and errors out: - `X-Robots-Tag: noindex` - ` nofollow` Switch to `pflag.GetStringArray`, which does not split on commas[1]. Note that this changes behavior for cases where multiple headers were provided in a single argument with commas (`--header-down "X-Foo: Bar,X-Bar: Foo"`). Such cases will now be treated as a single header value. If this breaking change is unacceptable, we will need a smarter fallback mechanism. [1] https://github.com/spf13/pflag/pull/90

Gilbert Gilb's committed Sep 23, 2025 at 05:12 UTC f5c3094050566d8d4fcf9f3ecf7d26f9c3241c65
2 files changed +6 -6
modules/caddyhttp/reverseproxy/command.go
+4 -4
@@ -75,8 +75,8 @@ For proxying:
75 cmd.Flags().BoolP("insecure", "", false, "Disable TLS verification (WARNING: DISABLES SECURITY BY NOT VERIFYING TLS CERTIFICATES!)")
76 cmd.Flags().BoolP("disable-redirects", "r", false, "Disable HTTP->HTTPS redirects")
77 cmd.Flags().BoolP("internal-certs", "i", false, "Use internal CA for issuing certs")
78 - cmd.Flags().StringSliceP("header-up", "H", []string{}, "Set a request header to send to the upstream (format: \"Field: value\")")
79 - cmd.Flags().StringSliceP("header-down", "d", []string{}, "Set a response header to send back to the client (format: \"Field: value\")")
78 + cmd.Flags().StringArrayP("header-up", "H", []string{}, "Set a request header to send to the upstream (format: \"Field: value\")")
79 + cmd.Flags().StringArrayP("header-down", "d", []string{}, "Set a response header to send back to the client (format: \"Field: value\")")
80 cmd.Flags().BoolP("access-log", "", false, "Enable the access log")
81 cmd.Flags().BoolP("debug", "v", false, "Enable verbose debug logs")
82 cmd.RunE = caddycmd.WrapCommandFuncForCobra(cmdReverseProxy)
@@ -182,7 +182,7 @@ func cmdReverseProxy(fs caddycmd.Flags) (int, error) {
182 }
183
184 // set up header_up
185 - headerUp, err := fs.GetStringSlice("header-up")
185 + headerUp, err := fs.GetStringArray("header-up")
186 if err != nil {
187 return caddy.ExitCodeFailedStartup, fmt.Errorf("invalid header flag: %v", err)
188 }
@@ -204,7 +204,7 @@ func cmdReverseProxy(fs caddycmd.Flags) (int, error) {
204 }
205
206 // set up header_down
207 - headerDown, err := fs.GetStringSlice("header-down")
207 + headerDown, err := fs.GetStringArray("header-down")
208 if err != nil {
209 return caddy.ExitCodeFailedStartup, fmt.Errorf("invalid header flag: %v", err)
210 }
modules/caddyhttp/staticresp.go
+2 -2
@@ -79,7 +79,7 @@ Response headers may be added using the --header flag for each header field.
79 cmd.Flags().StringP("body", "b", "", "The body of the HTTP response")
80 cmd.Flags().BoolP("access-log", "", false, "Enable the access log")
81 cmd.Flags().BoolP("debug", "v", false, "Enable more verbose debug-level logging")
82 - cmd.Flags().StringSliceP("header", "H", []string{}, "Set a header on the response (format: \"Field: value\")")
82 + cmd.Flags().StringArrayP("header", "H", []string{}, "Set a header on the response (format: \"Field: value\")")
83 cmd.RunE = caddycmd.WrapCommandFuncForCobra(cmdRespond)
84 },
85 })
@@ -359,7 +359,7 @@ func cmdRespond(fl caddycmd.Flags) (int, error) {
359 }
360
361 // build headers map
362 - headers, err := fl.GetStringSlice("header")
362 + headers, err := fl.GetStringArray("header")
363 if err != nil {
364 return caddy.ExitCodeFailedStartup, fmt.Errorf("invalid header flag: %v", err)
365 }