Kévin Dunglas 0d98caea58 fastcgi: reject paths whose escaped form selects another script (#8357) ...

(cherry picked from commit 3d005442e4)

2026-11-04 18:05:11 -05:00

..

caddyauth

caddyauth: Don't write into shared hash buffer when building cache key (#8278)

2026-11-03 18:25:44 -05:00

encode

encode: use httpguts to look for Accept-Encoding in Vary (#8329)

2026-11-03 00:53:50 -05:00

fileserver

fastcgi: reject Win 8.3 aliases and alt data streams paths (#8356)

2026-11-04 18:05:11 -05:00

headers

caddyhttp: presize buffers in hot paths to reduce allocations (#7842)

2026-11-04 18:05:11 -05:00

intercept

intercept: fix misleading handle_response error for extra matcher args (#7871)

2026-07-12 09:16:34 +10:00

logging

…

map

map: reject malformed destination placeholders (#8074)

2026-09-28 22:19:51 +10:00

proxyprotocol

…

push

…

requestbody

requestbody: enforce max_size early using Content-Length (#8337)

2026-11-03 18:25:44 -05:00

reverseproxy

fastcgi: reject paths whose escaped form selects another script (#8357)

2026-11-04 18:05:11 -05:00

rewrite

caddyhttp: presize buffers in hot paths to reduce allocations (#7842)

2026-11-04 18:05:11 -05:00

standard

caddyhttp: mitigate slowloris via idle read/write deadlines (#7913)

2026-08-21 21:17:26 -06:00

templates

templates: use the earliest front matter closing fence (#8259)

2026-11-03 00:53:19 -05:00

timeouts

caddyhttp: only bound HTTP/2 body reads in flight with the idle timeout (#8125)

2026-11-03 00:53:03 -05:00

tracing

tracing: fix BatchSpanProcessor goroutine leak on config reload (#7826)

2026-06-18 11:42:58 -06:00

app_test.go

caddyhttp: wait for servers from previous configs on exit (#8009)

2026-09-30 11:15:18 -06:00

app.go

fastcgi: keep the php_fastcgi directory redirect on the same origin (#8285)

2026-11-03 00:53:19 -05:00

autohttps_test.go

…

autohttps.go

…

caddyhttp_bench_test.go

caddyhttp: presize buffers in hot paths to reduce allocations (#7842)

2026-11-04 18:05:11 -05:00

caddyhttp_test.go

…

caddyhttp.go

caddyhttp: presize buffers in hot paths to reduce allocations (#7842)

2026-11-04 18:05:11 -05:00

celmatcher_test.go

caddyhttp: add CEL expression support to the tls matcher (#8088)

2026-11-03 00:53:19 -05:00

celmatcher.go

caddyhttp: Reject repeated expression matchers in a matcher set (#8183)

2026-11-03 00:53:04 -05:00

errors_randstring_test.go

caddyhttp: fix randString sameCase dictionary to match its docs (#7972)

2026-09-25 16:01:50 +00:00

errors.go

build: bump all dependencies - (Go 1.26 floor) (#8056)

2026-09-30 10:54:12 -06:00

http2listener.go

…

httpredirectlistener.go

…

idletimeout_test.go

caddyhttp: let handler read deadlines cap the idle read timeout (#8284)

2026-11-03 00:53:41 -05:00

idletimeout.go

caddyhttp: let handler read deadlines cap the idle read timeout (#8284)

2026-11-03 00:53:41 -05:00

incremental_test.go

feat: implement the Incremental header field (RFC 10036) (#8020)

2026-10-02 20:59:34 -04:00

incremental.go

feat: implement the Incremental header field (RFC 10036) (#8020)

2026-10-02 20:59:34 -04:00

invoke.go

…

ip_matchers.go

chore(deps): bump cel-go and switch import to new url (#8030)

2026-09-17 04:09:23 +03:00

ip_range.go

…

logging_test.go

caddyhttp: ignore case when matching hosts in logger_names (#8176)

2026-11-03 00:53:04 -05:00

logging.go

httpcaddyfile: Add log_level directive for access logs (#8201)

2026-11-03 00:53:10 -05:00

marshalers.go

…

matchers_test.go

fastcgi: reject Win 8.3 aliases and alt data streams paths (#8356)

2026-11-04 18:05:11 -05:00

matchers.go

caddyhttp: presize buffers in hot paths to reduce allocations (#7842)

2026-11-04 18:05:11 -05:00

metrics_test.go

…

metrics.go

build: bump all dependencies - (Go 1.26 floor) (#8056)

2026-09-30 10:54:12 -06:00

replacer_test.go

caddyhttp: keep absent optional placeholders empty (#8019)

2026-10-03 01:54:13 +00:00

replacer.go

fastcgi: keep the php_fastcgi directory redirect on the same origin (#8285)

2026-11-03 00:53:19 -05:00

responsematchers_test.go

…

responsematchers.go

…

responsewriter_test.go

…

responsewriter.go

…

routes.go

caddyhttp: skip matchers for satisfied route groups (#8189)

2026-11-03 00:53:04 -05:00

server_test.go

caddyhttp: reject invalid and dots-only hosts on every protocol (#8328)

2026-11-03 18:21:22 -05:00

server.go

caddyhttp: reject invalid and dots-only hosts on every protocol (#8328)

2026-11-03 18:21:22 -05:00

staticerror.go

…

staticresp_test.go

caddyhttp: keep absent optional placeholders empty (#8019)

2026-10-03 01:54:13 +00:00

staticresp.go

caddyhttp: only replace known placeholders in respond headers (#8014)

2026-09-13 12:08:21 +10:00

subroute.go

…

urlpatternmatcher_test.go

caddyhttp: fix url_pattern authorization bypass via encoded-slash traversal (#7941)

2026-08-15 10:38:20 -06:00

urlpatternmatcher.go

chore(deps): bump cel-go and switch import to new url (#8030)

2026-09-17 04:09:23 +03:00

vars_test.go

caddyhttp: surface 413 for oversized request body placeholders (#7969)

2026-09-25 22:27:19 +10:00

vars.go

caddyhttp: use errors.AsType for request body limit errors (#8090)

2026-09-30 13:50:42 -06:00