From 4c07a287da4451c2e1aa22f7163e7baa18e445b9 Mon Sep 17 00:00:00 2001
From: Immanuel Tikhonov <122638311+immanuwell@users.noreply.github.com>
Date: Mon, 1 Jun 2026 02:41:27 +0400
Subject: [PATCH] fix: reject invalid any and local config (#8133)

Signed-off-by: immanuwell <pchpr.00@list.ru>
---
 plugin/any/setup.go        |  8 ++++++++
 plugin/any/setup_test.go   | 14 ++++++++++++++
 plugin/local/setup.go      |  8 ++++++++
 plugin/local/setup_test.go | 34 ++++++++++++++++++++++++++++++++++
 4 files changed, 64 insertions(+)
 create mode 100644 plugin/local/setup_test.go

diff --git a/plugin/any/setup.go b/plugin/any/setup.go
index 5c8a93b9d..ec7ff47b5 100644
--- a/plugin/any/setup.go
+++ b/plugin/any/setup.go
@@ -9,6 +9,14 @@ import (
 func init() { plugin.Register("any", setup) }
 
 func setup(c *caddy.Controller) error {
+	c.Next() // 'any'
+	if c.NextArg() {
+		return plugin.Error("any", c.ArgErr())
+	}
+	if c.NextBlock() {
+		return plugin.Error("any", c.Errf("unknown property '%s'", c.Val()))
+	}
+
 	a := Any{}
 
 	dnsserver.GetConfig(c).AddPlugin(func(next plugin.Handler) plugin.Handler {
diff --git a/plugin/any/setup_test.go b/plugin/any/setup_test.go
index 49c5ae827..c5e2a229f 100644
--- a/plugin/any/setup_test.go
+++ b/plugin/any/setup_test.go
@@ -19,3 +19,17 @@ func TestSetup(t *testing.T) {
 		t.Error("Expected plugin to be added to config")
 	}
 }
+
+func TestSetupRejectsArgs(t *testing.T) {
+	c := caddy.NewTestController("dns", `any example.org`)
+	if err := setup(c); err == nil {
+		t.Fatal("expected error for unexpected argument, got nil")
+	}
+}
+
+func TestSetupRejectsBlockOptions(t *testing.T) {
+	c := caddy.NewTestController("dns", `any { foo }`)
+	if err := setup(c); err == nil {
+		t.Fatal("expected error for unexpected block option, got nil")
+	}
+}
diff --git a/plugin/local/setup.go b/plugin/local/setup.go
index 9bd0dd605..798a69c4d 100644
--- a/plugin/local/setup.go
+++ b/plugin/local/setup.go
@@ -9,6 +9,14 @@ import (
 func init() { plugin.Register("local", setup) }
 
 func setup(c *caddy.Controller) error {
+	c.Next() // 'local'
+	if c.NextArg() {
+		return plugin.Error("local", c.ArgErr())
+	}
+	if c.NextBlock() {
+		return plugin.Error("local", c.Errf("unknown property '%s'", c.Val()))
+	}
+
 	l := Local{}
 
 	dnsserver.GetConfig(c).AddPlugin(func(next plugin.Handler) plugin.Handler {
diff --git a/plugin/local/setup_test.go b/plugin/local/setup_test.go
new file mode 100644
index 000000000..a3a3ccb44
--- /dev/null
+++ b/plugin/local/setup_test.go
@@ -0,0 +1,34 @@
+package local
+
+import (
+	"testing"
+
+	"github.com/coredns/caddy"
+	"github.com/coredns/coredns/core/dnsserver"
+)
+
+func TestSetup(t *testing.T) {
+	c := caddy.NewTestController("dns", `local`)
+	if err := setup(c); err != nil {
+		t.Fatalf("expected no errors, but got: %v", err)
+	}
+
+	cfg := dnsserver.GetConfig(c)
+	if len(cfg.Plugin) == 0 {
+		t.Fatal("expected plugin to be added to config")
+	}
+}
+
+func TestSetupRejectsArgs(t *testing.T) {
+	c := caddy.NewTestController("dns", `local example.org`)
+	if err := setup(c); err == nil {
+		t.Fatal("expected error for unexpected argument, got nil")
+	}
+}
+
+func TestSetupRejectsBlockOptions(t *testing.T) {
+	c := caddy.NewTestController("dns", `local { foo }`)
+	if err := setup(c); err == nil {
+		t.Fatal("expected error for unexpected block option, got nil")
+	}
+}