From b9b992a81726a8aec3658559fd1327109d99c097 Mon Sep 17 00:00:00 2001 From: Toby Chui Date: Sun, 6 Apr 2025 16:49:44 +0800 Subject: [PATCH] Fixed #626 - Added checks for port in hostname redirection in dpcore util --- src/mod/dynamicproxy/dpcore/dpcore.go | 1 - src/mod/dynamicproxy/dpcore/utils.go | 18 ++++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/mod/dynamicproxy/dpcore/dpcore.go b/src/mod/dynamicproxy/dpcore/dpcore.go index 8f858e4..eb0a489 100644 --- a/src/mod/dynamicproxy/dpcore/dpcore.go +++ b/src/mod/dynamicproxy/dpcore/dpcore.go @@ -339,7 +339,6 @@ func (p *ReverseProxy) ProxyHTTP(rw http.ResponseWriter, req *http.Request, rrr } } else if strings.HasPrefix(originLocation, "/") && rrr.PathPrefix != "" { //Back to the root of this proxy object - //fmt.Println(rrr.ProxyDomain, rrr.OriginalHost) locationRewrite = strings.TrimSuffix(rrr.PathPrefix, "/") + originLocation } else { //Relative path. Do not modifiy location header diff --git a/src/mod/dynamicproxy/dpcore/utils.go b/src/mod/dynamicproxy/dpcore/utils.go index ab878e2..edac154 100644 --- a/src/mod/dynamicproxy/dpcore/utils.go +++ b/src/mod/dynamicproxy/dpcore/utils.go @@ -36,6 +36,24 @@ func replaceLocationHost(urlString string, rrr *ResponseRewriteRuleSet, useTLS b //Do not modify location header return urlString, nil } + + //Issue #626: Check if the location header is another subdomain with port + //E.g. Proxy config: blog.example.com -> 127.0.0.1:80 + //Check if it is actually redirecting to (*.)blog.example.com:8080 instead of current domain + //like Location: http://x.blog.example.com:1234/ + _, newLocationPort, err := net.SplitHostPort(u.Host) + if (newLocationPort == "80" || newLocationPort == "443") && err == nil { + //Port 80 or 443, some web server use this to switch between http and https + //E.g. http://example.com:80 -> https://example.com:443 + //E.g. http://example.com:443 -> https://example.com:80 + //That usually means the user have invalidly configured the web server to use port 80 or 443 + //for http or https. We should not modify the location header in this case. + + } else { + //Other port numbers. Do not modify location header + return urlString, nil + } + u.Host = rrr.OriginalHost if strings.Contains(rrr.ProxyDomain, "/") {