Nginx config: what is the meaning of the following lines

Question

Can anyone explain the reason of adding the following lines, in Nginx config, when used with php-fpm

    location ~ \..*/.*\.php$ {
            return 403;
    }

Thanks.

Answer 1

You'd better read about the regular expression in order to understand this. The above config means that a request begin with a dot, followed by any characters, then slash, and end with something.php will be forbidden, for eg:

http://domain.com/.abc/def.php

---

$ telnet localhost 81
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET /.abc/def.php HTTP/1.0

HTTP/1.1 403 Forbidden
Server: nginx/1.0.5
Date: Wed, 19 Oct 2011 15:09:58 GMT
Content-Type: text/html
Content-Length: 168
Connection: close

Answer 2

There are some long threads about cgi.fix_pathinfo = 1 and why it is a security problem on the nginx boards, in a few words without that rule in default setups one can masquerade a non php file(like a .jpg) as a php one and trick the server into processing the code in the malicious file.

Drupal, Wordpress, Squirrel etc pass their parameters to scripts through queries like /index.php?q=user/login [or user:login]. It's usually hidden in the url (cleaning/masking) yet thats how it works.

If you're using CGI to pass the request to a backend, you need to pass it in a parameter called PATH_INFO. The php developers have included a feature (stupidly enabled by default) that makes use of this.

This leads to a security problem with most common Nginx setups. Someone uploads a malicious php file to your server, say with a jpg extension. Then they go to http://server.com/sites/server.com/files/mybadfile.jpg/whatever.php

Because it ends in .php common nginx configs just pass it to the php backend as SOMESCRIPT whatever.php. Due to cgi.fix_pathinfo = 1, PHP then "fixes" the request by changing that to be SOMESCRIPT mybadfile.jpg and PATH_INFO /whatever.php and executes mybadfile.jpg as a php script.

You can imagine the rest.

what the regular expression means is that any direct request to any file in any subdirectory is to be forbidden [return 403] if the file ends with .php

[the .php$ part with $ showing the end of the line, whatever ends with that]

to understand that or regular expressions in general you should probably search the nginx documentation or regular expressions in general

Answer 3

See here: http://forum.nginx.org/read.php?2,88845,88996

Long story short, in some setups, someone could upload a malicious file (JPG, whatever) and get it processed by PHP.