Fix nginx security bugs in DDEV config - #4270
Conversation
- location ~ ^/(index.php|ipn.php|install/index.php|install/install.php) had no trailing $, so it prefix-matched instead of requiring an exact entry-point filename. - Both PHP-related regexes had an unescaped leading dot (`.` matches any character, not just a literal dot), including the final catch-all `.(php)$` deny rule. - The sensitive-file extension list had `yam` instead of `yaml`/`yml`, so those extensions were never actually blocked. - No protection at all for composer.json/README.md/CHANGELOG.md, unlike src/.htaccess, which blocks these explicitly. Verified against the real file with an isolated nginx+php-fpm harness before and after: confirmed config.yaml, composer.json, and README.md were served as static 200s pre-fix and are 403 post-fix, confirmed routing (front-controller path resolution, query strings, all four real entry points) is unaffected, and confirmed `nginx -t` passes on the file as committed.
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review. 📝 SummarySummary by CodeRabbit
WalkthroughThe nginx development configuration tightens regex matching for sensitive files and PHP paths. It adds YAML, Composer, README, and changelog patterns, escapes literal dots, and anchors exact PHP path matches. ChangesNginx Regex Hardening
Merge Risk: ⚪ Minimal · up to This localized nginx configuration update addresses the listed filename-matching and sensitive-file protection issues without any identified merge-blocking risk; it is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
1 participant
What
Fixes three real nginx bugs in the DDEV local-dev config (
.ddev/nginx_full/fossbilling.dev.conf).Bugs fixed
$anchor on the PHP entry-point allow-list.location ~ ^/(index.php|ipn.php|install/index.php|install/install.php)prefix-matched instead of requiring an exact filename..matches any character, not just a literal dot), including the final.(php)$deny-all rule.yamtypo in the sensitive-extension list —.yaml/.ymlfiles were never actually blocked, despite the rule's intent.composer.json/README.md/CHANGELOG.md, unlikesrc/.htaccess, which blocks these explicitly. Added a matching rule (merged into the existing sensitive-fileslocationvia regex alternation rather than a separate block, since that's how.htaccesstreats it — one combined check).