S
S
Sergey Pugovkin2017-05-28 20:28:08
Nginx
Sergey Pugovkin, 2017-05-28 20:28:08

Is it possible in nginx to rise above the document root via the request URI?

nginx.org/ru/docs/http/ngx_http_core_module.html#v...

$request_filename
path to the file for the current request, formed from the root or alias directives and the request URI

And if a URI like '/../../../etc'. Does nginx take this into account by limiting the request to the document root?
Would such a design be safe?
root /home/sergey/www;
location / {
    try_files $uri $uri/ =404;
}
location ~ \.lua$ {
    default_type text/html;
    content_by_lua_file $request_filename;
}

Answer the question

In order to leave comments, you need to log in

1 answer(s)
B
Boris Korobkov, 2017-05-28
@Driver86

Safely. You can't rise above root by specifying "../" in a URI.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question