Caddy v2.11.3: Rewrite handler placeholder re-expansion vulnerability

Caddy v2.11.3 has been identified as vulnerable to three distinct issues, according to the GitHub Security Advisory database. One of these vulnerabilities involves the rewrite handler's placeholder re-expansion mechanism. Specifically, when the rewrite URI template contains a placeholder resolving to request data and ends with a trailing `?`, attacker-controlled header values can be re-expanded during query string construction. This behavior allows for potential disclosure of environment variables or file contents, as the attacker-injected data flows through multiple stages of processing.

Operators should carefully inspect their Caddyfile configurations for any use of the rewrite handler with URI templates containing placeholders and trailing `?`. This vulnerability is particularly concerning in environments where user-supplied headers are processed, as it could lead to unauthorized access to sensitive data. Before upgrading or applying mitigations, operators should test their configurations in isolated environments to ensure that any changes do not inadvertently disrupt existing functionality. This issue highlights the importance of regression testing across similar code paths, as the vulnerability mirrors a previously patched flaw in another module.