summaryrefslogtreecommitdiff
path: root/modules
diff options
context:
space:
mode:
Diffstat (limited to 'modules')
-rw-r--r--modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go7
1 files changed, 7 insertions, 0 deletions
diff --git a/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go b/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
index 18d7e75..2848133 100644
--- a/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
+++ b/modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go
@@ -110,6 +110,13 @@ func (t *Transport) Provision(ctx caddy.Context) error {
// RoundTrip implements http.RoundTripper.
func (t Transport) RoundTrip(r *http.Request) (*http.Response, error) {
+ // Disallow null bytes in the request path, because
+ // PHP upstreams may do bad things, like execute a
+ // non-PHP file as PHP code. See #4574
+ if strings.Contains(r.URL.Path, "\x00") {
+ return nil, caddyhttp.Error(http.StatusBadRequest, fmt.Errorf("invalid request path"))
+ }
+
env, err := t.buildEnv(r)
if err != nil {
return nil, fmt.Errorf("building environment: %v", err)