From 7103ea096fffd851a5efd67fd6d30cf65bc38873 Mon Sep 17 00:00:00 2001
From: Francis Lavoie <lavofr@gmail.com>
Date: Wed, 23 Aug 2023 23:27:57 -0400
Subject: caddyfile: Fix case where heredoc marker is empty after newline
 (#5769)

Fixes `panic: runtime error: slice bounds out of range [:3] with capacity 2`

Co-authored-by: Matt Holt <mholt@users.noreply.github.com>
---
 caddyconfig/caddyfile/lexer.go      | 4 ++++
 caddyconfig/caddyfile/lexer_test.go | 5 +++++
 2 files changed, 9 insertions(+)

(limited to 'caddyconfig')

diff --git a/caddyconfig/caddyfile/lexer.go b/caddyconfig/caddyfile/lexer.go
index 6f72b5d..bfd6c0f 100644
--- a/caddyconfig/caddyfile/lexer.go
+++ b/caddyconfig/caddyfile/lexer.go
@@ -154,6 +154,10 @@ func (l *lexer) next() (bool, error) {
 			// we reset the val because the heredoc is syntax we don't
 			// want to keep.
 			if ch == '\n' {
+				if len(val) == 2 {
+					return false, fmt.Errorf("missing opening heredoc marker on line #%d; must contain only alpha-numeric characters, dashes and underscores; got empty string", l.line)
+				}
+
 				// check if there's too many <
 				if string(val[:3]) == "<<<" {
 					return false, fmt.Errorf("too many '<' for heredoc on line #%d; only use two, for example <<END", l.line)
diff --git a/caddyconfig/caddyfile/lexer_test.go b/caddyconfig/caddyfile/lexer_test.go
index ce2f533..92acc4d 100644
--- a/caddyconfig/caddyfile/lexer_test.go
+++ b/caddyconfig/caddyfile/lexer_test.go
@@ -409,6 +409,11 @@ EOF same-line-arg
 				},
 			},
 		},
+		{
+			input:        []byte("not-a-heredoc <<\n"),
+			expectErr:    true,
+			errorMessage: "missing opening heredoc marker on line #1; must contain only alpha-numeric characters, dashes and underscores; got empty string",
+		},
 		{
 			input: []byte(`heredoc <<<EOF
 	content
-- 
cgit v1.2.3