ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2025-01-12 14:16:55 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

services: nginx: Harden php-location settings.

Browse source 
* gnu/services/web.scm (nginx-php-location): Only pass existing PHP files
to the back end.  Mitigate httpoxy vulnerability.
This commit is contained in:
Bruno Victal 2023-04-05 16:34:08 +01:00 committed by Tobias Geerinckx-Rice
parent 849f31d574
commit cbc14b3bae
No known key found for this signature in database
GPG key ID: 0DB0FF884F556D79
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
gnu/services/web.scm
View file

@ -1144,6 +1144,14 @@ (define* (nginx-php-location
(uri "~ \\.php$")
(body (list
"fastcgi_split_path_info ^(.+\\.php)(/.+)$;"
;; Include some upstream recommendations from
;; https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi
;; Mitigate https://httpoxy.org/ vulnerabilities
"fastcgi_param HTTP_PROXY \"\";"
;; Only pass existing php files to the backend.
"if (!-f $document_root$fastcgi_script_name) { return 404; }"
(string-append "fastcgi_pass unix:" socket ";")
"fastcgi_index index.php;"
(list "include " nginx-package "/share/nginx/conf/fastcgi.conf;")))))