reverseproxy: Sanitize scheme and host on incoming requests (#4237)

* caddyhttp: Sanitize scheme and host on incoming requests * reverseproxy: Sanitize the URL scheme and host before proxying * Apply suggestions from code review Co-authored-by: Matt Holt <mholt@users.noreply.github.com> Co-authored-by: Matt Holt <mholt@users.noreply.github.com>

Francis Lavoie committed Oct 26, 2021 at 16:41 UTC f73f55dba745a8a527202b87fdd3ff88fa9f40b1

1 file changed +14

modules/caddyhttp/reverseproxy/reverseproxy.go

+14

@@ -395,9 +395,23 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyht

395 // should not permanently change r.Host; issue #3509)

396 reqHost := r.Host

397 reqHeader := r.Header

398 +

399 + // sanitize the request URL; we expect it to not contain the scheme and host

400 + // since those should be determined by r.TLS and r.Host respectively, but

401 + // some clients may include it in the request-line, which is technically

402 + // valid in HTTP, but breaks reverseproxy behaviour, overriding how the

403 + // dialer will behave. See #4237 for context.

404 + origURLScheme := r.URL.Scheme

405 + origURLHost := r.URL.Host

406 + r.URL.Scheme = ""

407 + r.URL.Host = ""

408 +

409 + // restore modifications to the request after we're done proxying

410 defer func() {

411 r.Host = reqHost // TODO: data race, see #4038

412 r.Header = reqHeader // TODO: data race, see #4038

413 + r.URL.Scheme = origURLScheme

414 + r.URL.Host = origURLHost

415 }()

416

417 start := time.Now()