mirror of
https://github.com/caddyserver/caddy.git
synced 2026-11-13 20:24:18 +00:00
7591cff1fb
The rewrite handler percent-decodes the path after expanding placeholders.
Regexp captures, usually taken from the already-decoded request path by
path_regexp, were inserted verbatim, so a double-encoded "../" or "?"
became a real separator or query string after path guards had run.
{http.regexp.*} values are now escaped like the other path-derived
placeholders (slashes preserved) when used in the path part of a rewrite.
Captures intentionally used to inject "?" into the path from a header or
other source must now set the query explicitly.
Based on a patch by Adel Assakaf.
Reviewed by mholt.
Code written by GitHub Copilot (Claude Opus 5.5), adapting the
contributor's patch.
Co-authored-by: Adel Assakaf <212399165+assakafpix@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>