nginx block if it contains breaks

Question

Looking to block any requests that contain the following strings in nginx

'%0d','%0a','%0D','%0A'

Just really looking to return like a 500 error or such.. Nothing fancy

Answer 1

I think a server-level if is what you need. If you want to search the whole request, including args, you should be able to use:

server {
  if ($request_uri ~ %0[adAD]) { return 500; }
}

If you just want to check the path part of the uri:

server {
  if ($uri ~ [\r\n]) { return 500; }
}

should do the job