From 5384982186d09b65c418c8d9d27170b11dd067e8 Mon Sep 17 00:00:00 2001 From: Joe Ferguson Date: Mon, 14 Sep 2026 09:39:29 -0500 Subject: [PATCH] Set Cache-Control to no-store on paths containing %2F/%5C/%2E --- include/prepend.inc | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/include/prepend.inc b/include/prepend.inc index c1fa1f99bd..1f8cd268b3 100644 --- a/include/prepend.inc +++ b/include/prepend.inc @@ -11,6 +11,19 @@ require_once __DIR__ . '/../src/autoload.php'; // See http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9 // for cache control header descriptions (used in many places on the site). +// Our CDN decodes %2F/%5C/%2E and resolves dot segments to build its cache key, +// but forwards the raw path to us, so a response for such a path can be stored +// under a different URL (www.php.net "/" was poisoned this way in 2026-09). +// Keep serving these requests, but never let the response be cached. +(function (): void { + $path = explode('?', $_SERVER['REQUEST_URI'] ?? '/', 2)[0]; + if (preg_match('~%(?:2f|5c|2e)|\\\\|(?:^|/)\.{1,2}(?:/|$)~i', $path)) { + header_register_callback(static function (): void { + header('Cache-Control: no-store'); + }); + } +})(); + // Provide default content-type, charset and language information // Manual pages will override this, and maybe others too header("Content-language: en");