search

YunoHost / package_linter

Linter for YunoHost applications packages
https://yunohost.org/#/packaging_apps
GNU Affero General Public License v3.0
17 stars 13 forks source link

Make path traversal issue detection more accurate #59

Closed alexAubin closed 4 years ago

alexAubin commented 5 years ago

c.f. https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/

When using an alias directirve, nginx.conf should follow https://github.com/YunoHost/example_ynh/blob/master/conf/nginx.conf (in particular the first two lines)

alexAubin commented 5 years ago

PR got merged ... I'm gonna keep this issue opened because we might want to find a way to have a more accurate way of analyzing the nginx conf file, there are too many clumsy / bold assumptions right now.