4 ms·

How is this not seen as a vulnerability in nginx? This behavior is utterly absurd, seems to have no beneficial purpose, and straightforwardly exploitable.

by amluto 3y ago

housemusicfan 3y ago
[flagged]
- kibwen 3y ago
  And a good carpenter understands that tools can be better or worse, and that a good carpenter who uses bad tools will be worse off than a good carpenter who uses good tools. It's not wrong of anyone (regardless of skill level) to demand better tools; power is not a blanket excuse for poor design. You can have powerful tools with non-dangerous defaults.
- tempest_ 3y ago
  That idiom is so dumb. There are 1000s of jobs that are incredibly easy with the tool for exactly that job but painful without, the auto industry alone has tonnes. Software with footguns can be improved by removing the footguns.
- phendrenad2 3y ago
  Falso dichotomy. Tools can be "powerful" without being easy to misconfigure. To use a carpenter example, circular saws have guard shields that snap into place if the saw is free in the air. Seems like a good thing, no? Are saws meaningfully less "powerful" because of this security feature?
  - housemusicfan 3y ago
    Shall we make straight razors illegal too while we're at it? Let's not reduce everything to the least common denominator lest we end up like (formerly) Oregon where you couldn't pump your own gas because it was "dangerous" for the lay person.
    - Frondo 3y ago
      I don't think you'd find a single woodworker anywhere who, if they could afford it, wouldn't prefer a table saw with Sawstop. How much are your fingers worth to you?
    - jeffparsons 3y ago
      Illegal? No, we don't need to do that. But we can certainly point out that safety razors already exist, are much easier to use safely and correctly, and do at least as good of a job for 99.9...÷ of people. This also means that if someone chooses to use a straight razor it is immediate cause for suspicion of their reasons (e.g. it might be an aesthetic preference rather than dispassionately choosing the best tool for the job) and if they advise other people to use that tool, we can call that out as bad advice. So we don't need to make Nginx illegal, or make that default illegal, but we can certainly point out that it's a foolish default when it offers no extra power to anyone, but offers significant risk to many.
- jerf 3y ago
  A poor craftsman blames his tools... instead of fixing them. How so many programmers read that as license to use crap tools boggles me.
  - antod 3y ago
    Yeah, after that phrase confusing me for years, I concluded that it really means a good craftsman won't even have bad (ie blame worthy) tools to begin with.
- mcfedr 3y ago
  There are quite a few such foot guns in nginx, it's part of why I've moved to using caddy.
- deleted 3y ago
  [deleted]
- tsimionescu 3y ago
  In the immortal words of Michael Bluth, a poor carpenter blames his shoddy tools.
- starttoaster 3y ago
  A poor carpenter blames his tools because it is the carpenter who maintains them. Unless you’re contributing back to upstream nginx’s code, the analogy isn’t apt. A carpenter could and should simply choose the best tool for the job, and when they determine what that tool is, maintain it as well as can be.
phendrenad2 3y ago
It's done for speed. Straightforward text replacement is so much faster than checking to see if a path is properly terminated by a slash. And remember that Nginx became popular due to benchmarks that showed that it was more "web scale" than Apache2.
- amluto 3y ago
  I find it hard to believe that searching for “..” would even show up in a benchmark. In any case, it seems that nginx does try to search for .. but has a bug in the corner case where the “location” doesn’t end with a slash. I assume there’s some kind of URL normalization pass that happens before the routing pass, and if the route matches part of a path component, nothing catches the .. If I’m right, this is just an IMO rather embarrassing bug and should he fixed.
  - D13Fd 3y ago
    Yeah, this whole thing reads to me like a bug in nginx. There is no obvious reason users would need that functionality.
    - m3affan 3y ago
      What are the alternarives though?
      - seanw444 3y ago
        To Nginx? HAProxy. Or Caddy if you're just doing web stuff.
        terom 3y ago
        HAProxy does not serve static files, so it's a poor alternative for this specific case.
- sofixa 3y ago
  > And remember that Nginx became popular due to benchmarks that showed that it was more "web scale" than Apache2. More like because it was much faster out of the box, and came with many batteries included while Apache2 required mods to be separately install.

How is this not seen as a vulnerability in nginx? This behavior is utterly absurd, seems to have no beneficial purpose, and straightforwardly exploitable.

by amluto 3y ago

How is this not seen as a vulnerability in nginx? This behavior is utterly absurd, seems to have no beneficial purpose, and straightforwardly exploitable.

housemusicfan 3y ago

[flagged]

kibwen 3y ago
And a good carpenter understands that tools can be better or worse, and that a good carpenter who uses bad tools will be worse off than a good carpenter who uses good tools. It's not wrong of anyone (regardless of skill level) to demand better tools; power is not a blanket excuse for poor design. You can have powerful tools with non-dangerous defaults.
tempest_ 3y ago
That idiom is so dumb. There are 1000s of jobs that are incredibly easy with the tool for exactly that job but painful without, the auto industry alone has tonnes. Software with footguns can be improved by removing the footguns.
phendrenad2 3y ago
Falso dichotomy. Tools can be "powerful" without being easy to misconfigure. To use a carpenter example, circular saws have guard shields that snap into place if the saw is free in the air. Seems like a good thing, no? Are saws meaningfully less "powerful" because of this security feature?
- housemusicfan 3y ago
  Shall we make straight razors illegal too while we're at it? Let's not reduce everything to the least common denominator lest we end up like (formerly) Oregon where you couldn't pump your own gas because it was "dangerous" for the lay person.
  - Frondo 3y ago
    I don't think you'd find a single woodworker anywhere who, if they could afford it, wouldn't prefer a table saw with Sawstop. How much are your fingers worth to you?
  - jeffparsons 3y ago
    Illegal? No, we don't need to do that. But we can certainly point out that safety razors already exist, are much easier to use safely and correctly, and do at least as good of a job for 99.9...÷ of people. This also means that if someone chooses to use a straight razor it is immediate cause for suspicion of their reasons (e.g. it might be an aesthetic preference rather than dispassionately choosing the best tool for the job) and if they advise other people to use that tool, we can call that out as bad advice. So we don't need to make Nginx illegal, or make that default illegal, but we can certainly point out that it's a foolish default when it offers no extra power to anyone, but offers significant risk to many.
jerf 3y ago
A poor craftsman blames his tools... instead of fixing them. How so many programmers read that as license to use crap tools boggles me.
- antod 3y ago
  Yeah, after that phrase confusing me for years, I concluded that it really means a good craftsman won't even have bad (ie blame worthy) tools to begin with.
mcfedr 3y ago
There are quite a few such foot guns in nginx, it's part of why I've moved to using caddy.
deleted 3y ago
[deleted]
tsimionescu 3y ago
In the immortal words of Michael Bluth, a poor carpenter blames his shoddy tools.
starttoaster 3y ago
A poor carpenter blames his tools because it is the carpenter who maintains them. Unless you’re contributing back to upstream nginx’s code, the analogy isn’t apt. A carpenter could and should simply choose the best tool for the job, and when they determine what that tool is, maintain it as well as can be.

phendrenad2 3y ago

It's done for speed. Straightforward text replacement is so much faster than checking to see if a path is properly terminated by a slash. And remember that Nginx became popular due to benchmarks that showed that it was more "web scale" than Apache2.

amluto 3y ago
I find it hard to believe that searching for “..” would even show up in a benchmark. In any case, it seems that nginx does try to search for .. but has a bug in the corner case where the “location” doesn’t end with a slash. I assume there’s some kind of URL normalization pass that happens before the routing pass, and if the route matches part of a path component, nothing catches the .. If I’m right, this is just an IMO rather embarrassing bug and should he fixed.
- D13Fd 3y ago
  Yeah, this whole thing reads to me like a bug in nginx. There is no obvious reason users would need that functionality.
  - m3affan 3y ago
    What are the alternarives though?
    - seanw444 3y ago
      To Nginx? HAProxy. Or Caddy if you're just doing web stuff.
      - terom 3y ago
        HAProxy does not serve static files, so it's a poor alternative for this specific case.
sofixa 3y ago
> And remember that Nginx became popular due to benchmarks that showed that it was more "web scale" than Apache2. More like because it was much faster out of the box, and came with many batteries included while Apache2 required mods to be separately install.