<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div class="post-text" itemprop="text">
<p>I have files that are served by the backend web app at <code>/xxx/File?file=yyy.png</code>.
These files are stored at <code>/storage/files</code> on the
server. So, I wrote a location block to serve these files from
storage directly from the web server.</p>
<p>Here is my first take:</p>
<pre><code>location /xxx/File {
if ($request_method = POST ) {
proxy_pass <a class="moz-txt-link-freetext" href="http://backend">http://backend</a>;
}
alias /storage/files/;
try_files $arg_file =404;
}
</code></pre>
<p>The issue is I can do something like <code>/xxx/File?file=../../etc/foo.bar</code>
and nginx will serve the foo.bar file for me. So, I switched to
this following:</p>
<pre><code>location /xxx/File {
if ($request_method = POST ) {
proxy_pass <a class="moz-txt-link-freetext" href="http://backend">http://backend</a>;
}
if ($arg_file ~ \.\.) { return 403; }
alias /storage/files/$arg_file;
}
</code></pre>
<p>Can someone point me to any corner cases that can be exploited
and what is the best practice for situations like these?<br>
</p>
<p>--<br>
Abhi<br>
</p>
</div>
</body>
</html>