caddyhttp: Fix header matcher when using nil

Uncovered in caddyserver#3807
gilbsgilbs · Nov 17, 2020 · 4fc5707 · 4fc5707
1 parent 99b8f44
commit 4fc5707
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/modules/caddyhttp/matchers.go b/modules/caddyhttp/matchers.go
@@ -445,6 +445,10 @@ func matchHeaders(input, against http.Header, host string) bool {
 			// match if the header field exists at all
 			continue
 		}
+		if allowedFieldVals == nil && actualFieldVals == nil {
+			// a nil list means match if the header does not exist at all
+			continue
+		}
 		var match bool
 	fieldVals:
 		for _, actualFieldVal := range actualFieldVals {

diff --git a/modules/caddyhttp/matchers_test.go b/modules/caddyhttp/matchers_test.go
@@ -480,6 +480,16 @@ func TestHeaderMatcher(t *testing.T) {
 			host:   "caddyserver.com",
 			expect: false,
 		},
+		{
+			match:  MatchHeader{"Must-Not-Exist": nil},
+			input:  http.Header{},
+			expect: true,
+		},
+		{
+			match:  MatchHeader{"Must-Not-Exist": nil},
+			input:  http.Header{"Must-Not-Exist": []string{"do not match"}},
+			expect: false,
+		},
 	} {
 		req := &http.Request{Header: tc.input, Host: tc.host}
 		actual := tc.match.Match(req)