caddy/modules/caddyhttp
Jay Hemnani bf3fa59201
caddyhttp: Reject repeated expression matchers in a matcher set (#8183)
* caddyhttp: Combine repeated expression matchers in a matcher set

The Caddyfile parser groups repeated matchers of the same type and hands
all their segments to the module, but the expression matcher only read
the first segment, so every later `expression` line in a named matcher
or `not` block was dropped without an error. Read every segment and AND
the expressions, like the other matchers in a set.

* caddyhttp: Put each joined expression on its own line

A trailing // comment in one expression no longer swallows the closing
parenthesis and the expressions joined after it.

* caddyhttp: Reject repeated expression matchers instead of joining them

A second expression line in a named matcher or a not block is now a
Caddyfile error that points to combining them with && in one expression,
instead of being dropped or joined with an implied operator.

(cherry picked from commit d4165a4eb1)
2026-11-03 00:53:04 -05:00
..
caddyauth caddyauth: only replace known placeholders in basic auth credentials (#8017) 2026-09-26 18:52:53 +10:00
encode encode: Don't write an empty encoded stream for HEAD responses (#8150) 2026-11-03 00:53:04 -05:00
fileserver fileserver: apply hide rules to browse entries and sidecars (#8155) 2026-11-03 00:53:03 -05:00
headers headers: Preserve separate Set-Cookie values (#8080) 2026-10-02 22:08:23 -04:00
intercept intercept: fix misleading handle_response error for extra matcher args (#7871) 2026-07-12 09:16:34 +10:00
logging
…
map map: reject malformed destination placeholders (#8074) 2026-09-28 22:19:51 +10:00
proxyprotocol
…
push
…
requestbody build: bump all dependencies - (Go 1.26 floor) (#8056) 2026-09-30 10:54:12 -06:00
reverseproxy reverseproxy: Only retry responses for expressions that use response data (#8168) 2026-11-03 00:53:04 -05:00
rewrite Merge commit from fork 2026-09-14 12:50:44 -06:00
standard caddyhttp: mitigate slowloris via idle read/write deadlines (#7913) 2026-08-21 21:17:26 -06:00
templates templates: Delete file headers on any template error (#8149) 2026-11-03 00:53:03 -05:00
timeouts caddyhttp: only bound HTTP/2 body reads in flight with the idle timeout (#8125) 2026-11-03 00:53:03 -05:00
tracing tracing: fix BatchSpanProcessor goroutine leak on config reload (#7826) 2026-06-18 11:42:58 -06:00
app.go caddyhttp: ignore case when matching hosts in logger_names (#8176) 2026-11-03 00:53:04 -05:00
app_test.go caddyhttp: wait for servers from previous configs on exit (#8009) 2026-09-30 11:15:18 -06:00
autohttps.go
…
autohttps_test.go
…
caddyhttp.go
…
caddyhttp_test.go
…
celmatcher.go caddyhttp: Reject repeated expression matchers in a matcher set (#8183) 2026-11-03 00:53:04 -05:00
celmatcher_test.go caddyhttp: Reject repeated expression matchers in a matcher set (#8183) 2026-11-03 00:53:04 -05:00
errors.go build: bump all dependencies - (Go 1.26 floor) (#8056) 2026-09-30 10:54:12 -06:00
errors_randstring_test.go caddyhttp: fix randString sameCase dictionary to match its docs (#7972) 2026-09-25 16:01:50 +00:00
http2listener.go chore: clean up wording and typo fixes (#7745) 2026-05-20 16:36:30 +10:00
httpredirectlistener.go chore: clean up wording and typo fixes (#7745) 2026-05-20 16:36:30 +10:00
idletimeout.go caddyhttp: preserve expired request-body read deadlines (#8178) 2026-11-03 00:53:04 -05:00
idletimeout_test.go caddyhttp: preserve expired request-body read deadlines (#8178) 2026-11-03 00:53:04 -05:00
incremental.go feat: implement the Incremental header field (RFC 10036) (#8020) 2026-10-02 20:59:34 -04:00
incremental_test.go feat: implement the Incremental header field (RFC 10036) (#8020) 2026-10-02 20:59:34 -04:00
invoke.go
…
ip_matchers.go chore(deps): bump cel-go and switch import to new url (#8030) 2026-09-17 04:09:23 +03:00
ip_range.go
…
logging.go caddyhttp: ignore case when matching hosts in logger_names (#8176) 2026-11-03 00:53:04 -05:00
logging_test.go caddyhttp: ignore case when matching hosts in logger_names (#8176) 2026-11-03 00:53:04 -05:00
marshalers.go
…
matchers.go chore(deps): bump cel-go and switch import to new url (#8030) 2026-09-17 04:09:23 +03:00
matchers_test.go caddyhttp: fix path_regexp (MatchPathRE) Windows backslash bypass (#7858) 2026-07-11 08:37:44 +10:00
metrics.go build: bump all dependencies - (Go 1.26 floor) (#8056) 2026-09-30 10:54:12 -06:00
metrics_test.go
…
replacer.go caddyhttp: keep absent optional placeholders empty (#8019) 2026-10-03 01:54:13 +00:00
replacer_test.go caddyhttp: keep absent optional placeholders empty (#8019) 2026-10-03 01:54:13 +00:00
responsematchers.go
…
responsematchers_test.go
…
responsewriter.go
…
responsewriter_test.go
…
routes.go caddyhttp: skip matchers for satisfied route groups (#8189) 2026-11-03 00:53:04 -05:00
server.go caddyhttp: document that negative idle timeouts disable them (#8146) 2026-11-03 00:53:03 -05:00
server_test.go caddyhttp: document that negative idle timeouts disable them (#8146) 2026-11-03 00:53:03 -05:00
staticerror.go
…
staticresp.go caddyhttp: only replace known placeholders in respond headers (#8014) 2026-09-13 12:08:21 +10:00
staticresp_test.go caddyhttp: keep absent optional placeholders empty (#8019) 2026-10-03 01:54:13 +00:00
subroute.go
…
urlpatternmatcher.go chore(deps): bump cel-go and switch import to new url (#8030) 2026-09-17 04:09:23 +03:00
urlpatternmatcher_test.go caddyhttp: fix url_pattern authorization bypass via encoded-slash traversal (#7941) 2026-08-15 10:38:20 -06:00
vars.go caddyhttp: use errors.AsType for request body limit errors (#8090) 2026-09-30 13:50:42 -06:00
vars_test.go caddyhttp: surface 413 for oversized request body placeholders (#7969) 2026-09-25 22:27:19 +10:00