![防止 Kubernetes 中的 nginx ingress 目录遍历](https://linux22.com/image/758557/%E9%98%B2%E6%AD%A2%20Kubernetes%20%E4%B8%AD%E7%9A%84%20nginx%20ingress%20%E7%9B%AE%E5%BD%95%E9%81%8D%E5%8E%86.png)
我定义了以下入口:
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: someName
namespace: test
annotations:
kubernetes.io/ingress.class: "ingress-public"
nginx.ingress.kubernetes.io/affinity: "cookie"
nginx.ingress.kubernetes.io/session-cookie-name: "JSESSIONID"
nginx.ingress.kubernetes.io/connection-proxy-header: "keep-alive"
nginx.ingress.kubernetes.io/server-snippet: |
# block if not / or /test or /something
if ($request_uri !~* "(^\/(?:(?:test|something)(?:\/|$)|$))") {
return 404 ;
break;
}
# redirect if proto_http
if ($http_x_forwarded_proto = 'http') {
return 301 https://$host$request_uri;
break;
}
# hsts required header
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
spec:
rules:
- host: myhost.example.com
http:
paths:
- path: /
backend:
serviceName: someservice
servicePort: 80
正则表达式涵盖了大多数请求的情况,例如/config
- 由于这与正则表达式不匹配,因此返回 404。
我目前面临两个问题。
/test%2F..%2Fconfig
即使与正则表达式不匹配,请求也不会返回 404。- 请求
/test/..%2Fconfig
允许您到达/config
。
那么,是否存在更好的正则表达式可以涵盖这些情况,或者是否有办法将其转换$request_uri
为绝对 uri,以便正则表达式可以在其上工作而不是编码 uri?
正则表达式在这里有一些测试用例:https://regex101.com/r/Msu402/1