Re: Fixing the well Documented Nginx Alias Traversal Vulnerability?

Hi Maxim, > The "i.." string is a valid path component and there are no reasons why it shouldn't be allowed - there might be such files and/or directories on the disk. Do you have any metrics on how often this is truly used? Or how common this file path really is? Is the argument here that "this

Re: [PATCH 0/4] SSL: Add support for loading X.509 certificates from openssl engine

Hello! On Thu, Jul 13, 2023 at 10:38:02AM +0300, Vesa Jääskeläinen via nginx-devel wrote: > Hi Maxim, > > On 13.7.2023 3.48, Maxim Dounin wrote: > > Hello! > > > > On Wed, Jul 12, 2023 at 05:07:03PM +0300, Vesa Jääskeläinen via nginx-devel > > wrote: > > > >> (I hope this goes properly out as

Re: Fixing the well Documented Nginx Alias Traversal Vulnerability?

Hello! On Fri, Jul 14, 2023 at 06:50:54PM -0400, Jonathan Leitschuh wrote: > Hi Maxim, > > > The "i.." string is a valid path component and there are no reasons why > it shouldn't be allowed - there might be such files and/or directories on > the disk. > > Do you have any metrics on how often t

[PATCH] Added debug_random directive

# HG changeset patch # User J Carter # Date 1689391559 -3600 # Sat Jul 15 04:25:59 2023 +0100 # Node ID b1ea0a60417e547513654bf9d6bb79714865c780 # Parent 77c1418916f7817a0d020f28d8a08f278a12fe43 Added debug_random directive This directive enforces for EITHER a percentage of total connection