Caddy 2.11.8 → 2.11.9
1 release · 5 breaking changes · 6 security fixes · 0 advisories fixed
6security5breaking0deprecated6feature0fix
Breaking changes
- breaking Conflicting client_auth is now a Caddyfile error. When two site blocks share TLS connection policies for the same hostname but set different client_auth, the adapter used to keep the first one and silently drop the other, which could quietly remove a stricter mTLS requirement. (#8306) in 2.11.9
- breaking FastCGI requests that are ambiguous about which script they run get 400: in 2.11.9
- breaking when the escaped path (which %-containing path matchers see) and the decoded path would select different scripts, e.g. /public/tool.php%2f..%2f..%2fadmin%2ftool.php (#8357) in 2.11.9
- breaking on Windows, script paths with an 8.3 short name component (like ADMINI~1) or a : (NTFS alternate data streams) (#8356) in 2.11.9
- breaking FastCGI env values now take precedence over request headers, so a client can no longer override HTTP_* variables you set with env (see below). (#8358) in 2.11.9
Security changes
- security fastcgi: A client could override any HTTP_* variable set with the FastCGI transport's (or php_fastcgi's) env subdirective by sending a matching request header, for example choosing the user an application sees in HTTP_X_AUTH_USER. Configured values now win. Reported by @JebeenLee and @Camel4,… in 2.11.9
- security fastcgi: On Windows, NTFS 8.3 short names and alternate data streams could run a script that a path rule was meant to deny, completing the FastCGI fix from 2.11.8. Thanks @dunglas. (GHSA-9cr8-wmhh-39pm, #8356) in 2.11.9
- security fastcgi: Encoded slashes and dot segments could make a %-containing path matcher approve one script while another one runs. Thanks @dunglas. (#8357) in 2.11.9
- security fastcgi: Over HTTP/2, a host field sent next to :authority could make the application see a different host (HTTP_HOST) than the one Caddy routed the request to. Thanks @dunglas. (#8355) in 2.11.9
- security httpcaddyfile: A stricter client_auth could be silently dropped when merging TLS connection policies (see above). Thanks @sam-kota. (#8306) in 2.11.9
- security Updated go-jose to v4.1.6 for GHSA-mgcc-cww5-fp2q. (#8299) in 2.11.9
Every release in between
featureFixed: PHP directory indexes (regression in 2.11.8). A request for a directory with a trailing slash, like /wp-admin/, was matched by the directory itself instead of its index.php, so it never reached PHP and usually got a 404. This broke WordPress admin pages and other apps that serve an index…
featurePath matchers with placeholders now work as expected: placeholders like {env.FOO} are no longer lower-cased into {env.foo} before they're looked up, and their values are compared case-insensitively against the request path, like static patterns. Thanks @BenMacha! (#8343)
featureNew plain_time_format option for file_server browse: sets the time layout of plain-text directory listings (Accept: text/plain). Thanks @steffenbusch! (#8084)
featureFewer allocations in path cleaning, header rewriting and weighted_round_robin selection. Thanks @jvoisin! (#7842)
featureFor plugin authors: new httpcaddyfile.Helper.IsNamedRoute() tells a directive whether it's being parsed inside a named route. (#8354)
breakingConflicting client_auth is now a Caddyfile error. When two site blocks share TLS connection policies for the same hostname but set different client_auth, the adapter used to keep the first one and silently drop the other, which could quietly remove a stricter mTLS requirement. (#8306)
breakingFastCGI requests that are ambiguous about which script they run get 400:
breakingwhen the escaped path (which %-containing path matchers see) and the decoded path would select different scripts, e.g. /public/tool.php%2f..%2f..%2fadmin%2ftool.php (#8357)
breakingon Windows, script paths with an 8.3 short name component (like ADMINI~1) or a : (NTFS alternate data streams) (#8356)
breakingFastCGI env values now take precedence over request headers, so a client can no longer override HTTP_* variables you set with env (see below). (#8358)
securityfastcgi: A client could override any HTTP_* variable set with the FastCGI transport's (or php_fastcgi's) env subdirective by sending a matching request header, for example choosing the user an application sees in HTTP_X_AUTH_USER. Configured values now win. Reported by @JebeenLee and @Camel4,…
securityfastcgi: On Windows, NTFS 8.3 short names and alternate data streams could run a script that a path rule was meant to deny, completing the FastCGI fix from 2.11.8. Thanks @dunglas. (GHSA-9cr8-wmhh-39pm, #8356)
securityfastcgi: Encoded slashes and dot segments could make a %-containing path matcher approve one script while another one runs. Thanks @dunglas. (#8357)
securityfastcgi: Over HTTP/2, a host field sent next to :authority could make the application see a different host (HTTP_HOST) than the one Caddy routed the request to. Thanks @dunglas. (#8355)
securityhttpcaddyfile: A stricter client_auth could be silently dropped when merging TLS connection policies (see above). Thanks @sam-kota. (#8306)
securityUpdated go-jose to v4.1.6 for GHSA-mgcc-cww5-fp2q. (#8299)
othercaddyhttp: lower-case path patterns with placeholders at request time
otherhttpcaddyfile: reject conflicting client_auth when merging TLS policies
otherbuild(deps): bump the actions-deps group across 1 directory with 10 updates
otherbuild(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6
otherfileserver: make plain-text browse time format configurable
otherfileserver: only match a dir when the pattern ends by /
featurehttpcaddyfile: add Helper.IsNamedRoute
otherfastcgi: take HTTP_HOST from the routed host only
otherfastcgi: reject Win 8.3 aliases and alt data streams paths
othercaddyhttp: presize buffers in hot paths to reduce allocations
otherfastcgi: let configured env variables override request headers
otherfastcgi: reject paths whose escaped form selects another script