[Compy]

…for any invalid path errors. (close #7008 #7007)

Background
Currently when using the static file server, when injecting a null byte into the request path, the server returns a 500. Edge infrastructure such as nginx, Apache, AWS ELB and Cloudflare treat these types of errors with a 400 Bad Request, which is more indicative of a bad input compared to an application-level 500 response.

This change adds error handling for fs.PathError to the mapDirOpenError() function by mapping it to fs.ErrInvalid, and modifies the caller (ServeHTTP()) to explicitly return http.StatusBadRequest for fs.ErrInvalid errors.

Local tests are positive. Unit tests are also passing. Tested on both MacOS and Linux/Ubuntu 24.

Before the change:

curl http://localhost:8080/foo.txt%00 -vvvv
* Host localhost:8080 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8080...
* Connected to localhost (::1) port 8080
> GET /foo.txt%00 HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 500 Internal Server Error
< Server: Caddy
< Date: Tue, 13 May 2025 02:52:15 GMT
< Content-Length: 0
< 
* Connection #0 to host localhost left intact

After the change:

curl http://localhost:8080/foo.txt%00 -vvvv
* Host localhost:8080 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8080...
* Connected to localhost (::1) port 8080
> GET /foo.txt%00 HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 400 Bad Request
< Server: Caddy
< Date: Tue, 13 May 2025 02:54:16 GMT
< Content-Length: 0
< 
* Connection #0 to host localhost left intact

[mholt]

Ah thanks, this is pretty simple. Looks like a good patch.

[mholt]

@Compy Could you take a look at this change relative to this report: https://caddy.community/t/nextcloud-setup-broken-after-update-to-2-10-2/33140

It might be that we are applying this error a bit too generously... (or, maybe we are just now returning an error where before a bug was being covered up?)