From 01adf07c5ea3254078d95b2ab4311f47a2b6c3ce Mon Sep 17 00:00:00 2001 From: Alexandre Aubin Date: Thu, 8 Oct 2020 16:06:19 +0200 Subject: [PATCH] Fix an edge case of path traversal detection --- package_linter.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/package_linter.py b/package_linter.py index ae0b1d2..d1ef925 100755 --- a/package_linter.py +++ b/package_linter.py @@ -526,6 +526,9 @@ class App(TestSuite): for block in nginxconf: for location, alias in find_location_with_alias(block): + # Ignore locations which are regexes..? + if location.startswith("^") and location.endswith("$"): + continue alias_path = alias[-1] # For path traversal issues to occur, both of those are needed : # - location /foo { (*without* a / after foo)