Does Caddy do a 308 redirect somehow?

[sleepyhead]

1. Caddy version (caddy version):

2.4.6

2. How I run Caddy:

a. System environment:

Ubuntu. Systemd

Sendy web app

b. Command:

Paste command here.

c. Service/unit/compose file:

Paste full file contents here.
Make sure backticks stay on their own lines,
and the post looks nice in the preview pane.

d. My complete Caddyfile or JSON config:

  root * /var/www/sendy
  tls foo@example.org

  file_server
  log {
    output file /var/log/caddy/sendy.access.log {
      roll_size 3MiB
      roll_keep 5
      roll_keep_for 48h
    }
    format console
  }
  php_fastcgi unix//run/php/php7.0-fpm.sock {
    split .php
    index index.php
  }
  try_files {path} {path}.php
  #@catch {
  #  path_regexp ^/([a-zA-Z0-9-]+)$
  #}
  #rewrite @catch {path}.php
  
  @w path_regexp w ^/w/([a-zA-Z0-9/]+)$
  rewrite @w w.php?i={re.w.1}
  @l path_regexp l ^/l/([a-zA-Z0-9/]+)$
  rewrite @l l.php?i={re.l.1}
  @t path_regexp t ^/t/([a-zA-Z0-9/]+)$
  rewrite @t t.php?i={re.t.q}
  @unsub path_regexp unsub ^/unsubscribe/(.*)$
  rewrite @unsub unsubscribe.php?i={re.unsub.q}
  @sub path_regexp sub ^/subscribe/(.*)$
  rewrite @sub subscribe.php?i={req.sub.q}

3. The problem I’m having:

I am running Sendy web app from Caddy. I am seeing a redirect that I am unable to find the cause of.

Request https://example.org/\evil.com/%2F… gives 308 redirect to evil.com. I cannot see that Sendy is doing a 308 redirect. Is my Caddy config causing a 308 redirect?

I am trying to fix this redirect so a user will not be redirected out of my domain.

4. Error messages and/or full log output:

5. What I already tried:

Finding 308 redirect in Sendy source files.

6. Links to relevant resources:

[matt (Matt Holt)]

I think this should be fixed on tip:

caddyhttp: Fix `MatchPath` sanitizing

Can you build with the latest commits and verify?

[sleepyhead]

Yeah this patch fixes it, thanks!