From ed69ea57b05218b7b59e2a0f7adbf53f19158120 Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Sat, 24 Oct 2026 10:17:40 +0000 Subject: [PATCH] fix(proxy): refuse dot segments resolved after the route check Signed-off-by: Oleksandr Piskun --- lib/Controller/ExAppProxyController.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/Controller/ExAppProxyController.php b/lib/Controller/ExAppProxyController.php index 3be91889..a59df953 100644 --- a/lib/Controller/ExAppProxyController.php +++ b/lib/Controller/ExAppProxyController.php @@ -237,9 +237,10 @@ private function prepareProxy( string $appId, string $other, array &$route, array &$bruteforceProtection, int &$delay ): ?ExApp { $delay = 0; - if (preg_match('#(?:^|/|%2[fF])(?:\.|%2[eE]){2}(?:/|%2[fF]|$)#', $other) === 1) { + // The forwarded path ends at "?" or "#", curl resolves dot segments, Tomcat drops ";" parameters first. + if (preg_match('#(?:^|/|%2[fF])(?:\.|%2[eE]){1,2}(?:[/;?\#]|%2[fF]|$)#', $other) === 1) { $this->logger->debug( - sprintf('Returning status 404 for "%s": path contains a parent-directory segment.', $other) + sprintf('Returning status 404 for "%s": path contains a dot segment.', $other) ); return null; }