Skip to content

Commit fc5c302

Browse files
ScottHamperrhukster
ScottHamper
authored and
rhukster
committed
[WIP] Web Server Config URL Rewrite Rules White List (getgrav#1458)
* Escaped literal periods in web server config files rewrite rules. * Black listed "yml" file extension in web server configs rewrite rules.
1 parent 04243f7 commit fc5c302

File tree

7 files changed

+28
-28
lines changed

7 files changed

+28
-28
lines changed

‎.htaccess‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,17 +54,17 @@ RewriteRule .* index.php [L]
5454

5555
## Begin - Security
5656
# Block all direct access for these folders
57-
RewriteRule ^(.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
57+
RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
5858
# Block access to specific file types for these system folders
59-
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ error [F]
59+
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F]
6060
# Block access to specific file types for these user folders
61-
RewriteRule ^(user)/(.*)\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ error [F]
61+
RewriteRule ^(user)/(.*)\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F]
6262
# Block all direct access to .md files:
6363
RewriteRule \.md$ error [F]
6464
# Block all direct access to files and folders beginning with a dot
6565
RewriteRule (^|/)\.(?!well-known) - [F]
6666
# Block access to specific files in the root folder
67-
RewriteRule ^(LICENSE.txt|composer.lock|composer.json|\.htaccess)$ error [F]
67+
RewriteRule ^(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$ error [F]
6868
## End - Security
6969

7070
</IfModule>

‎webserver-configs/Caddyfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,22 @@ fastcgi / 127.0.0.1:9000 php
55
# Begin - Security
66
# deny all direct access for these folders
77
rewrite {
8-
r /(.git|cache|bin|logs|backups|tests)/.*$
8+
r /(\.git|cache|bin|logs|backups|tests)/.*$
99
to /403
1010
}
1111
# deny running scripts inside core system folders
1212
rewrite {
13-
r /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$
13+
r /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$
1414
to /403
1515
}
1616
# deny running scripts inside user folder
1717
rewrite {
18-
r /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$
18+
r /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$
1919
to /403
2020
}
2121
# deny access to specific files in the root folder
2222
rewrite {
23-
r /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess)
23+
r /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess)
2424
to /403
2525
}
2626

‎webserver-configs/Caddyfile-0.8.x‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,22 @@ fastcgi / 127.0.0.1:9000 php
77
# Begin - Security
88
# deny all direct access for these folders
99
rewrite {
10-
r /(.git|cache|bin|logs|backups|tests)/.*$
10+
r /(\.git|cache|bin|logs|backups|tests)/.*$
1111
status 403
1212
}
1313
# deny running scripts inside core system folders
1414
rewrite {
15-
r /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$
15+
r /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$
1616
status 403
1717
}
1818
# deny running scripts inside user folder
1919
rewrite {
20-
r /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$
20+
r /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$
2121
status 403
2222
}
2323
# deny access to specific files in the root folder
2424
rewrite {
25-
r /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess)
25+
r /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess)
2626
status 403
2727
}
2828
## End - Security

‎webserver-configs/htaccess.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -54,22 +54,22 @@ RewriteRule .* index.php [L]
5454

5555
## Begin - Security
5656
# Block all direct access for these folders
57-
RewriteRule ^(.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
57+
RewriteRule ^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*) error [F]
5858
# Block access to specific file types for these system folders
59-
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ error [F]
59+
RewriteRule ^(system|vendor)/(.*)\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F]
6060
# Block access to specific file types for these user folders
61-
RewriteRule ^(user)/(.*)\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ error [F]
61+
RewriteRule ^(user)/(.*)\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ error [F]
6262
# Block all direct access to .md files:
6363
RewriteRule \.md$ error [F]
6464
# Block all direct access to files and folders beginning with a dot
6565
RewriteRule (^|/)\.(?!well-known) - [F]
6666
# Block access to specific files in the root folder
67-
RewriteRule ^(LICENSE.txt|composer.lock|composer.json|\.htaccess)$ error [F]
67+
RewriteRule ^(LICENSE\.txt|composer\.lock|composer\.json|\.htaccess)$ error [F]
6868
## End - Security
6969

7070
</IfModule>
7171

7272
# Begin - Prevent Browsing and Set Default Resources
7373
Options -Indexes
7474
DirectoryIndex index.php index.html index.htm
75-
# End - Prevent Browsing and Set Default Resources
75+
# End - Prevent Browsing and Set Default Resources

‎webserver-configs/lighttpd.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ url.rewrite-if-not-file = (
2727
)
2828

2929
#IMPROVING SECURITY
30-
$HTTP["url"] =~ "^/grav_path/(LICENSE.txt|composer.json|composer.lock|nginx.conf|web.config)$" {
30+
$HTTP["url"] =~ "^/grav_path/(LICENSE\.txt|composer\.json|composer\.lock|nginx\.conf|web\.config)$" {
3131
url.access-deny = ("")
3232
}
33-
$HTTP["url"] =~ "^/grav_path/(.git|cache|bin|logs|backup|tests)/(.*)" {
33+
$HTTP["url"] =~ "^/grav_path/(\.git|cache|bin|logs|backup|tests)/(.*)" {
3434
url.access-deny = ("")
3535
}
36-
$HTTP["url"] =~ "^/grav_path/(system|user|vendor)/(.*)\.(txt|md|html|yaml|php|twig|sh|bat)$" {
36+
$HTTP["url"] =~ "^/grav_path/(system|user|vendor)/(.*)\.(txt|md|html|yaml|yml|php|twig|sh|bat)$" {
3737
url.access-deny = ("")
3838
}
3939
$HTTP["url"] =~ "^/grav_path/(\.(.*))" {

‎webserver-configs/nginx.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ server {
1818

1919
## Begin - Security
2020
# deny all direct access for these folders
21-
location ~* /(.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
21+
location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
2222
# deny running scripts inside core system folders
23-
location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
23+
location ~* /(system|vendor)/.*\.(txt|xml|md|html|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
2424
# deny running scripts inside user folder
25-
location ~* /user/.*\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
25+
location ~* /user/.*\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
2626
# deny access to specific files in the root folder
27-
location ~ /(LICENSE.txt|composer.lock|composer.json|nginx.conf|web.config|htaccess.txt|\.htaccess) { return 403; }
27+
location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
2828
## End - Security
2929

3030
## Begin - PHP

‎webserver-configs/web.config‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,19 @@
1818
<action type="Rewrite" url="index.php" />
1919
</rule>
2020
<rule name="user_error_redirect" stopProcessing="true">
21-
<match url="^(user)/(.*)\.(txt|md|yaml|php|pl|py|cgi|twig|sh|bat)$" ignoreCase="false" />
21+
<match url="^(user)/(.*)\.(txt|md|yaml|yml|php|pl|py|cgi|twig|sh|bat)$" ignoreCase="false" />
2222
<action type="Redirect" url="error" redirectType="Permanent" />
2323
</rule>
2424
<rule name="ignore_folders" stopProcessing="true">
25-
<match url="^(.git|cache|bin|logs|backup|webserver-configs|tests)/(.*)" ignoreCase="false" />
25+
<match url="^(\.git|cache|bin|logs|backup|webserver-configs|tests)/(.*)" ignoreCase="false" />
2626
<action type="Redirect" url="error" redirectType="Permanent" />
2727
</rule>
2828
<rule name="system" stopProcessing="true">
29-
<match url="^system/(.*)\.(txt|md|html|yaml|php|twig|sh|bat)$" ignoreCase="false" />
29+
<match url="^system/(.*)\.(txt|md|html|yaml|yml|php|twig|sh|bat)$" ignoreCase="false" />
3030
<action type="Redirect" url="error" redirectType="Permanent" />
3131
</rule>
3232
<rule name="vendor" stopProcessing="true">
33-
<match url="^vendor/(.*)\.(txt|md|html|yaml|php|twig|sh|bat)$" ignoreCase="false" />
33+
<match url="^vendor/(.*)\.(txt|md|html|yaml|yml|php|twig|sh|bat)$" ignoreCase="false" />
3434
<action type="Redirect" url="error" redirectType="Permanent" />
3535
</rule>
3636
</rules>

0 commit comments

Comments
 (0)