nixos/tests/acme: Use exact match in TOS location
Since the switch to check the nginx config with gixy in 59fac1a6, the ACME test doesn't build anymore, because gixy reports the following false-positive (reindented): >> Problem: [alias_traversal] Path traversal via misconfigured alias. Severity: MEDIUM Description: Using alias in a prefixed location that doesn't ends with directory separator could lead to path traversal vulnerability. Additional info: https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md Pseudo config: server { server_name letsencrypt.org; location /documents/2017.11.15-LE-SA-v1.2.pdf { alias /nix/store/y4h5ryvnvxkajkmqxyxsk7qpv7bl3vq7-2017.11.15-LE-SA-v1.2.pdf; } } The reason this is a false-positive is because the destination is not a directory, so something like "/foo.pdf../other.txt" won't work here, because the resulting path would be ".../destfile.pdf../other.txt"...
parent
f3099279
Please register or sign in to comment