admin: expect quoted ETags (#4879)v2.5.2

* expect quoted etags

* admin: Minor refactor of etag facilities

Co-authored-by: Matthew Holt <[email protected]>

1 files changed, 9 insertions, 1 deletions

diff --git a/caddy.go b/caddy.go
index 0c6dfcd00..98ee5b39b 100644
--- a/caddy.go
+++ b/caddy.go
@@ -145,8 +145,16 @@ func changeConfig(method, path string, input []byte, ifMatchHeader string, force
 	defer currentCfgMu.Unlock()
 
 	if ifMatchHeader != "" {
+		// expect the first and last character to be quotes
+		if len(ifMatchHeader) < 2 || ifMatchHeader[0] != '"' || ifMatchHeader[len(ifMatchHeader)-1] != '"' {
+			return APIError{
+				HTTPStatus: http.StatusBadRequest,
+				Err:        fmt.Errorf("malformed If-Match header; expect quoted string"),
+			}
+		}
+
 		// read out the parts
-		parts := strings.Fields(ifMatchHeader)
+		parts := strings.Fields(ifMatchHeader[1 : len(ifMatchHeader)-1])
 		if len(parts) != 2 {
 			return APIError{
 				HTTPStatus: http.StatusBadRequest,