Skip to content

Commit 9faa23c

Browse files
csandanovcsandanov
committed
Update 404 rules for md files, closes #93
- Drupal preset: .md files excluded from the default not found regex - Drupal preset: CHANGELOG, README, INSTALL, FAQ, LICENSE md files in modules directory now return 404 - WP preset: CHANGELOG, README, INSTALL, FAQ, LICENSE md files in plugins directory now return 404
1 parent 0c80f20 commit 9faa23c

File tree

9 files changed

+66
-13
lines changed

9 files changed

+66
-13
lines changed

‎Makefile‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,12 +66,11 @@ buildx-imagetools-create:
6666
.PHONY: buildx-imagetools-create
6767

6868
test:
69-
# cd ./tests/basic && IMAGE=$(REPO):$(TAG) ./run.sh
70-
# cd ./tests/php && IMAGE=$(REPO):$(TAG) ./run.sh
71-
# cd ./tests/wordpress && IMAGE=$(REPO):$(TAG) ./run.sh
72-
# cd ./tests/drupal/11 && IMAGE=$(REPO):$(TAG) ./run.sh
69+
cd ./tests/basic && IMAGE=$(REPO):$(TAG) ./run.sh
70+
cd ./tests/php && IMAGE=$(REPO):$(TAG) ./run.sh
71+
cd ./tests/wordpress && IMAGE=$(REPO):$(TAG) ./run.sh
72+
cd ./tests/drupal/11 && IMAGE=$(REPO):$(TAG) ./run.sh
7373
cd ./tests/drupal/10 && IMAGE=$(REPO):$(TAG) ./run.sh
74-
cd ./tests/drupal/7 && IMAGE=$(REPO):$(TAG) ./run.sh
7574
cd ./tests/matomo && PLATFORM=$(PLATFORM) IMAGE=$(REPO):$(TAG) ./run.sh
7675

7776
push:

‎README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -315,8 +315,9 @@ Overridden default values:
315315
add `$NGINX_WP_GOOGLE_XML_SITEMAP=1`
316316
- For plugin [Yoast SEO](https://kb.yoast.com/kb/xml-sitemaps-nginx/) add `$NGINX_WP_YOAST_XML_SITEMAP=1`
317317
- Default value of `NGINX_HEADERS_CONTENT_SECURITY_POLICY` overridden to `frame-ancestors: 'self'`
318+
- Files `INSTALL.md`, `README.md`, `LICENSE.md`, `FAQ.md` and `CHANGELOG.md` inside plugins directory return 404
318319

319-
Default value of NGINX_WP_NOT_FOUND_REGEX (backspaces must be escaped) is: `.+\\.(?:txt|md|pot|sh|.*sql?)|(?:composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$`
320+
Default value of NGINX_WP_NOT_FOUND_REGEX (backspaces must be escaped) is: `.+\\.(?:txt|pot|sh|.*sql?)|(?:composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$`
320321

321322
#### Drupal
322323

@@ -329,14 +330,15 @@ Default value of NGINX_WP_NOT_FOUND_REGEX (backspaces must be escaped) is: `.+\\
329330
- Access to cert extensions gives 404 based on the value of `$NGINX_DRUPAL_NOT_FOUND_REGEX`
330331
- Default value of `NGINX_HEADERS_CONTENT_SECURITY_POLICY` overridden to `frame-ancestors: 'self'`
331332
- Set `NGINX_DRUPAL_REMOVE_INDEXPHP` to any value to remove `index.php` from the URL, e.g. `index.php/node/abc` will redirect to `/node/abc`
333+
- Files `INSTALL.md`, `README.md`, `LICENSE.md`, `FAQ.md` and `CHANGELOG.md` inside modules directory return 404
332334

333335
Default value of `NGINX_DRUPAL_NOT_FOUND_REGEX` (backspaces must be escaped) is taken from Drupal's `.htaccess` and
334336
depends on the Drupal version:
335337

336338
Drupal 11/10/9/8:
337339

338340
```
339-
\\.(engine|md|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$
341+
\\.(engine|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$
340342
```
341343

342344
Drupal 7:

‎templates/presets/drupal10.conf.tmpl‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{ $static := (getenv "NGINX_STATIC_EXT_REGEX" "css|cur|js|jpe?g|gif|htc|ico|png|xml|otf|ttf|eot|woff|woff2|svg|mp4|svgz|ogg|ogv|pdf|pptx?|zip|tgz|gz|rar|bz2|doc|xls|exe|tar|mid|midi|wav|bmp|rtf|txt|map|webp") }}
2-
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|md|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
2+
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
33
{{ $files_dir_static := (getenv "NGINX_DRUPAL_FILES_STATIC_EXT_REGEX" "txt") }}
44

55
index index.php index.html;
@@ -110,6 +110,10 @@ location / {
110110
return 404;
111111
}
112112

113+
location ~* ^/(?:sites/[^/]+/)?modules/(contrib|custom)/[a-z0-9_-]+/(CHANGELOG|README|INSTALL|LICENSE|FAQ)\.md$ {
114+
return 404;
115+
}
116+
113117
location ~* ^.+\.(?:{{ $static }})$ {
114118
access_log {{ getenv "NGINX_STATIC_ACCESS_LOG" "off" }};
115119
tcp_nodelay {{ getenv "NGINX_STATIC_TCP_NODELAY" "off" }};

‎templates/presets/drupal11.conf.tmpl‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{ $static := (getenv "NGINX_STATIC_EXT_REGEX" "css|cur|js|jpe?g|gif|htc|ico|png|xml|otf|ttf|eot|woff|woff2|svg|mp4|svgz|ogg|ogv|pdf|pptx?|zip|tgz|gz|rar|bz2|doc|xls|exe|tar|mid|midi|wav|bmp|rtf|txt|map|webp") }}
2-
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|md|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
2+
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
33
{{ $files_dir_static := (getenv "NGINX_DRUPAL_FILES_STATIC_EXT_REGEX" "txt") }}
44

55
index index.php index.html;
@@ -110,6 +110,10 @@ location / {
110110
return 404;
111111
}
112112

113+
location ~* ^/(?:sites/[^/]+/)?modules/(contrib|custom)/[a-z0-9_-]+/(CHANGELOG|README|INSTALL|LICENSE|FAQ)\.md$ {
114+
return 404;
115+
}
116+
113117
location ~* ^.+\.(?:{{ $static }})$ {
114118
access_log {{ getenv "NGINX_STATIC_ACCESS_LOG" "off" }};
115119
tcp_nodelay {{ getenv "NGINX_STATIC_TCP_NODELAY" "off" }};

‎templates/presets/drupal8.conf.tmpl‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{ $static := (getenv "NGINX_STATIC_EXT_REGEX" "css|cur|js|jpe?g|gif|htc|ico|png|xml|otf|ttf|eot|woff|woff2|svg|mp4|svgz|ogg|ogv|pdf|pptx?|zip|tgz|gz|rar|bz2|doc|xls|exe|tar|mid|midi|wav|bmp|rtf|txt|map|webp") }}
2-
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|md|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
2+
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
33
{{ $files_dir_static := (getenv "NGINX_DRUPAL_FILES_STATIC_EXT_REGEX" "txt") }}
44

55
index index.php index.html;
@@ -116,6 +116,10 @@ location / {
116116
return 404;
117117
}
118118

119+
location ~* ^/(?:sites/[^/]+/)?modules/(contrib|custom)/[a-z0-9_-]+/(CHANGELOG|README|INSTALL|LICENSE|FAQ)\.md$ {
120+
return 404;
121+
}
122+
119123
location ~* ^.+\.(?:{{ $static }})$ {
120124
access_log {{ getenv "NGINX_STATIC_ACCESS_LOG" "off" }};
121125
tcp_nodelay {{ getenv "NGINX_STATIC_TCP_NODELAY" "off" }};

‎templates/presets/drupal9.conf.tmpl‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{ $static := (getenv "NGINX_STATIC_EXT_REGEX" "css|cur|js|jpe?g|gif|htc|ico|png|xml|otf|ttf|eot|woff|woff2|svg|mp4|svgz|ogg|ogv|pdf|pptx?|zip|tgz|gz|rar|bz2|doc|xls|exe|tar|mid|midi|wav|bmp|rtf|txt|map|webp") }}
2-
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|md|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
2+
{{ $not_found_regex := (getenv "NGINX_DRUPAL_NOT_FOUND_REGEX" "\\.(engine|txt|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\\.php)?|xtmpl|yml|yaml)(~|\\.sw[op]|\\.bak|\\.orig|\\.save)?$|^(\\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template)$|(web\\.config|composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$|^#.*#$|\\.php(~|\\.sw[op]|\\.bak|\\.orig|\\.save)$") }}
33
{{ $files_dir_static := (getenv "NGINX_DRUPAL_FILES_STATIC_EXT_REGEX" "txt") }}
44

55
index index.php index.html;
@@ -110,6 +110,10 @@ location / {
110110
return 404;
111111
}
112112

113+
location ~* ^/(?:sites/[^/]+/)?modules/(contrib|custom)/[a-z0-9_-]+/(CHANGELOG|README|INSTALL|LICENSE|FAQ)\.md$ {
114+
return 404;
115+
}
116+
113117
location ~* ^.+\.(?:{{ $static }})$ {
114118
access_log {{ getenv "NGINX_STATIC_ACCESS_LOG" "off" }};
115119
tcp_nodelay {{ getenv "NGINX_STATIC_TCP_NODELAY" "off" }};

‎templates/presets/wordpress.conf.tmpl‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{ $static := (getenv "NGINX_STATIC_EXT_REGEX" "css|cur|js|jpe?g|gif|htc|ico|png|xml|otf|ttf|eot|woff|woff2|svg|mp4|svgz|ogg|ogv|pdf|pptx?|zip|tgz|gz|rar|bz2|doc|xls|exe|tar|mid|midi|wav|bmp|rtf|txt|map|webp") }}
2-
{{ $not_found_regex := (getenv "NGINX_WP_NOT_FOUND_REGEX" ".+\\.(?:txt|md|pot|sh|.*sql?)|(?:composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$") }}
2+
{{ $not_found_regex := (getenv "NGINX_WP_NOT_FOUND_REGEX" ".+\\.(?:txt|pot|sh|.*sql?)|(?:composer\\.(json|lock)|(package|package-lock)\\.json|yarn\\.lock)$") }}
33

44
index index.php index.html;
55

@@ -69,6 +69,10 @@ location / {
6969
return 404;
7070
}
7171

72+
location ~* ^/wp-content/plugins/[a-z0-9_-]+/(CHANGELOG|README|INSTALL|LICENSE|FAQ)\.md$ {
73+
return 404;
74+
}
75+
7276
location ~* /(?:uploads|files)/.*\.php$ {
7377
deny all;
7478
}

‎tests/drupal/11/run.sh‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ nginx_exec() {
1010
docker compose exec -T nginx "${@}"
1111
}
1212

13+
drupal_exec() {
14+
docker compose exec -T drupal "${@}"
15+
}
16+
1317
clean_exit() {
1418
docker compose down -v
1519
}
@@ -19,6 +23,15 @@ docker compose up -d
1923

2024
nginx_exec make check-ready -f /usr/local/bin/actions.mk
2125

26+
drupal_exec mkdir -p web/sites/abc/modules/contrib/test
27+
drupal_exec mkdir -p web/modules/contrib/test
28+
drupal_exec touch web/sites/abc/modules/contrib/test/CHANGELOG.md
29+
drupal_exec touch web/sites/abc/modules/contrib/test/README.md
30+
drupal_exec touch web/sites/abc/modules/contrib/test/INSTALL.md
31+
drupal_exec touch web/modules/contrib/test/CHANGELOG.md
32+
drupal_exec touch web/modules/contrib/test/README.md
33+
drupal_exec touch web/modules/contrib/test/INSTALL.md
34+
2235
# TODO: check endpoints of installed Drupal
2336

2437
echo "Checking Drupal endpoints"
@@ -66,4 +79,13 @@ nginx_exec curl -s -S -I "localhost/redirect-internal-permanent" | grep '301 Mov
6679
echo -n "Checking user-defined external redirect... "
6780
nginx_exec curl -s -S -I "localhost/redirect-external" | grep '302 Moved Temporarily'
6881
echo -n "Checking CSP header... "
69-
nginx_exec curl -s -S -I "localhost" | grep "frame-ancestors 'self'"
82+
nginx_exec curl -s -S -I "localhost" | grep "frame-ancestors 'self'"
83+
84+
echo -n "Checking modules md files... "
85+
nginx_exec curl -s -S -I "localhost/modules/contrib/test/README.md" | grep "404 Not Found"
86+
nginx_exec curl -s -S -I "localhost/modules/contrib/test/INSTALL.md" | grep "404 Not Found"
87+
nginx_exec curl -s -S -I "localhost/modules/contrib/test/CHANGELOG.md" | grep "404 Not Found"
88+
89+
nginx_exec curl -s -S -I "localhost/sites/abc/modules/contrib/test/README.md" | grep "404 Not Found"
90+
nginx_exec curl -s -S -I "localhost/sites/abc/modules/contrib/test/INSTALL.md" | grep "404 Not Found"
91+
nginx_exec curl -s -S -I "localhost/sites/abc/modules/contrib/test/CHANGELOG.md" | grep "404 Not Found"

‎tests/wordpress/run.sh‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@ docker compose up -d
2121
docker compose exec -T nginx make check-ready -f /usr/local/bin/actions.mk
2222
docker compose exec -T wordpress make init -f /usr/local/bin/actions.mk
2323

24+
docker compose exec -T wordpress mkdir -p web/wp-content/plugins/test
25+
docker compose exec -T wordpress touch web/wp-content/plugins/test/CHANGELOG.md
26+
docker compose exec -T wordpress touch web/wp-content/plugins/test/README.md
27+
docker compose exec -T wordpress touch web/wp-content/plugins/test/INSTALL.md
28+
2429
echo -n "Checking homepage endpoint... "
2530
check_endpoint "" "302 Found"
2631

@@ -53,3 +58,8 @@ check_endpoint "non-existing.php" "404 Not Found"
5358

5459
echo -n "Check CSP header... "
5560
check_endpoint "" "frame-ancestors 'self'"
61+
62+
echo -n "Checking modules md files... "
63+
check_endpoint "wp-content/plugins/test/README.md" "404 Not Found"
64+
check_endpoint "wp-content/plugins/test/INSTALL.md" "404 Not Found"
65+
check_endpoint "wp-content/plugins/test/CHANGELOG.md" "404 Not Found"

0 commit comments

Comments
 (0)