Skip to content

caddyhttp: fix escaped path matcher over-matching longer paths#7828

Open
alhudz wants to merge 1 commit into
caddyserver:masterfrom
alhudz:path-matcher-escape-overmatch
Open

caddyhttp: fix escaped path matcher over-matching longer paths#7828
alhudz wants to merge 1 commit into
caddyserver:masterfrom
alhudz:path-matcher-escape-overmatch

Conversation

@alhudz

@alhudz alhudz commented Jun 18, 2026

Copy link
Copy Markdown
Contributor

Repro: path /foo%2fbar (a %-escaped pattern with no trailing wildcard) matches a request to /foo%2fbarbaz. The plain pattern /foobar correctly does not match /foobarbaz, so escaped patterns silently behave like prefix matches.
Cause: matchPatternWithEscapeSequence walks the pattern and escaped path in lock-step and stops once the pattern is consumed, so trailing path bytes never make it into the string handed to path.Match; it then only ever sees the prefix.
Fix: append the remaining (normalised) path bytes after the loop so path.Match compares the whole path. Exact patterns now reject longer paths while wildcard patterns are unaffected.

@steadytao

Copy link
Copy Markdown
Member

@alhudz the code is fine but we really need the assistance disclosure mate...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants