[PATCH] Added debug_random directive

# HG changeset patch # User J Carter # Date 1689391559 -3600 # Sat Jul 15 04:25:59 2023 +0100 # Node ID b1ea0a60417e547513654bf9d6bb79714865c780 # Parent 77c1418916f7817a0d020f28d8a08f278a12fe43 Added debug_random directive This directive enforces for EITHER a percentage of total connection

Re: Fixing the well Documented Nginx Alias Traversal Vulnerability?

Hello! On Fri, Jul 14, 2023 at 06:50:54PM -0400, Jonathan Leitschuh wrote: > Hi Maxim, > > > The "i.." string is a valid path component and there are no reasons why > it shouldn't be allowed - there might be such files and/or directories on > the disk. > > Do you have any metrics on how often t

Re: [PATCH 0/4] SSL: Add support for loading X.509 certificates from openssl engine

Hello! On Thu, Jul 13, 2023 at 10:38:02AM +0300, Vesa Jääskeläinen via nginx-devel wrote: > Hi Maxim, > > On 13.7.2023 3.48, Maxim Dounin wrote: > > Hello! > > > > On Wed, Jul 12, 2023 at 05:07:03PM +0300, Vesa Jääskeläinen via nginx-devel > > wrote: > > > >> (I hope this goes properly out as

Re: Fixing the well Documented Nginx Alias Traversal Vulnerability?

Hi Maxim, > The "i.." string is a valid path component and there are no reasons why it shouldn't be allowed - there might be such files and/or directories on the disk. Do you have any metrics on how often this is truly used? Or how common this file path really is? Is the argument here that "this