Files
caddy/modules
Kévin Dunglas 5bd0b9355d fileserver: reject regular files addressed with a trailing separator (#8379)
* fileserver: don't serve regular file when path ends by slash

With canonical URIs disabled, file_server trimmed the trailing slash before
stat and served the file, while path matchers see "/secret.env/" and skip
rules such as "path *.env". Return 404 (or pass through) instead.

* fileserver: trim trailing OS separator before stat

On Windows, SanitizedPathJoin appends a backslash for a path ending in "/",
which the "/" trim left in place. Stat then failed on a regular file, so
"/file/" returned 400 instead of the canonical redirect or a 404.

* fileserver: keep trailing separator of a filesystem root

Trimming it turned a root of `C:\` into `C:`, the current directory of the
drive, and a root of `\` or `/` into an empty path, so requests for "/"
listed or indexed the wrong directory, or failed.

* fileserver: log request path on trailing slash 404

The logged filename has its trailing separator trimmed, so it didn't show the slash that caused the 404.

* fileserver: check trailing slash on matcher path
2026-11-09 07:33:40 +10:00
..