Skip to content

Detection of scenario when default is not specified for map directive #115

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
oxdef opened this issue Nov 12, 2020 · 1 comment
Open

Comments

@oxdef
Copy link

oxdef commented Nov 12, 2020

It looks like common case when map is used for some kind of authorization control. Simplified example could look like:

http {
...
    map $uri $mappocallow {
        /map-poc/private 0;
        /map-poc/secret 0;
        /map-poc/public 1;
    }
...
}
server {
...
    location /map-poc {
        if ($mappocallow = 0) {return 403;}
        return 200 "Hello. It is private area: $mappocallow";
    }
...
}

According to the manual:

default value
sets the resulting value if the source value matches none of the specified variants. When default is not specified, the default
resulting value will be an empty string.

It is easy to forget about default value. So malefactor can bypass this "authorization control" with simple https://targethost.com/map-poc/another-private-area. It will be great if gixy can detect such case.

@oxdef
Copy link
Author

oxdef commented Nov 18, 2020

Want to make PR but can't find in Block and Directive definitions how to get map block content :(

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant