From 60f36dbfb7404a178403865edd0423c53d91309d Mon Sep 17 00:00:00 2001
From: marvin <marvinwade@Marvins-MacBook-Pro.local>
Date: Tue, 15 Sep 2026 00:02:15 -0400
Subject: [PATCH] Fix caddyQuote() double-escaping backslashes, breaking the
 Block-common-exploits regex (v0.11.90)

---
 package.json  | 2 +-
 src/server.js | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 1e90a17..0cf5ddd 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "site-gateway",
-  "version": "0.11.89",
+  "version": "0.11.90",
   "private": true,
   "description": "Site Gateway: simple self-hosted website publishing, reverse proxying, and automatic HTTPS.",
   "type": "module",
diff --git a/src/server.js b/src/server.js
index 27907bc..ef330d4 100644
--- a/src/server.js
+++ b/src/server.js
@@ -328,7 +328,12 @@ function caddySiteAddress(item) {
 }
 
 function caddyQuote(value) {
-  return `"${String(value).replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", " ")}"`;
+  // Caddy's Caddyfile lexer only special-cases \" inside a quoted string — it does NOT
+  // collapse \\ into a single backslash (confirmed in caddyconfig/caddyfile/lexer.go: "all is
+  // literal in quoted area, so only escape quotes"). Doubling backslashes here, as this used to,
+  // corrupts any value that legitimately contains one (e.g. a regex like eval\( becomes eval\\(,
+  // which Caddy then reads as an escaped backslash followed by an unclosed real group).
+  return `"${String(value).replaceAll('"', '\\"').replaceAll("\n", " ")}"`;
 }
 
 function accessDirectives(accessListId) {