Browse Source

fastcgi: Protect against requests with null bytes in the path (#4614)

master
Francis Lavoie 3 years ago
committed by GitHub
parent
commit
c8f2834b51
No known key found for this signature in database GPG Key ID: 4AEE18F83AFDEB23
  1. 7
      modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go

7
modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go

@ -110,6 +110,13 @@ func (t *Transport) Provision(ctx caddy.Context) error {
// RoundTrip implements http.RoundTripper.
func (t Transport) RoundTrip(r *http.Request) (*http.Response, error) {
// Disallow null bytes in the request path, because
// PHP upstreams may do bad things, like execute a
// non-PHP file as PHP code. See #4574
if strings.Contains(r.URL.Path, "\x00") {
return nil, caddyhttp.Error(http.StatusBadRequest, fmt.Errorf("invalid request path"))
}
env, err := t.buildEnv(r)
if err != nil {
return nil, fmt.Errorf("building environment: %v", err)

Loading…
Cancel
Save