From cd88abd598568ebd6b3bef83c52f5969e7e2fbed Mon Sep 17 00:00:00 2001 From: Hammed Oyedele Date: Fri, 14 Aug 2026 23:35:07 +0100 Subject: [PATCH] fix: update security rules to prevent edge cases in PHP execution for storage directories Expanded the regex patterns in Apache, Nginx, and Caddy configurations to block PHP file execution more reliably by accounting for trailing slashes after `.php`. --- .../fpm-apache/etc/apache2/conf-available/security.conf | 4 ++-- .../fpm-nginx/etc/nginx/site-opts.d/http.conf.template | 8 ++++---- .../fpm-nginx/etc/nginx/site-opts.d/https.conf.template | 8 ++++---- src/variations/frankenphp/etc/frankenphp/Caddyfile | 4 ++-- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/src/variations/fpm-apache/etc/apache2/conf-available/security.conf b/src/variations/fpm-apache/etc/apache2/conf-available/security.conf index f572f2501..945308494 100644 --- a/src/variations/fpm-apache/etc/apache2/conf-available/security.conf +++ b/src/variations/fpm-apache/etc/apache2/conf-available/security.conf @@ -57,7 +57,7 @@ Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3) - + Require all denied @@ -80,4 +80,4 @@ Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains Require all denied # allow from xxx.xxx.xxx.xxx - \ No newline at end of file + diff --git a/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template b/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template index 08a90ff96..319843589 100644 --- a/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template +++ b/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template @@ -15,7 +15,7 @@ absolute_redirect off; # Healthcheck: Set /healthcheck to be the static health check URL location /healthcheck { access_log off; - + # set max 5 seconds for healthcheck fastcgi_read_timeout 5s; @@ -32,7 +32,7 @@ location / { # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3) -location ~* ^/storage/.*\.php$ { +location ~* ^/storage/.*\.php(?:/|$) { deny all; } @@ -42,10 +42,10 @@ location ~ \.php$ { fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; - fastcgi_buffers $NGINX_FASTCGI_BUFFERS; + fastcgi_buffers $NGINX_FASTCGI_BUFFERS; fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE; fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME; } # additional config -include /etc/nginx/server-opts.d/*.conf; \ No newline at end of file +include /etc/nginx/server-opts.d/*.conf; diff --git a/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template b/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template index 810ff0747..fce7efa3c 100644 --- a/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template +++ b/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template @@ -21,7 +21,7 @@ absolute_redirect off; # Healthcheck: Set /healthcheck to be the static health check URL location /healthcheck { access_log off; - + # set max 5 seconds for healthcheck fastcgi_read_timeout 5s; @@ -38,7 +38,7 @@ location / { # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3) -location ~* ^/storage/.*\.php$ { +location ~* ^/storage/.*\.php(?:/|$) { deny all; } @@ -48,10 +48,10 @@ location ~ \.php$ { fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; include fastcgi_params; - fastcgi_buffers $NGINX_FASTCGI_BUFFERS; + fastcgi_buffers $NGINX_FASTCGI_BUFFERS; fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE; fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME; } # additional config -include /etc/nginx/server-opts.d/*.conf; \ No newline at end of file +include /etc/nginx/server-opts.d/*.conf; diff --git a/src/variations/frankenphp/etc/frankenphp/Caddyfile b/src/variations/frankenphp/etc/frankenphp/Caddyfile index 50b2158be..add4cd7c4 100644 --- a/src/variations/frankenphp/etc/frankenphp/Caddyfile +++ b/src/variations/frankenphp/etc/frankenphp/Caddyfile @@ -97,7 +97,7 @@ fd00::/8 \ file_server import performance - import security + import security {$CADDY_SERVER_EXTRA_DIRECTIVES} } @@ -140,7 +140,7 @@ fd00::/8 \ # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3) - @storage-php path_regexp ^/storage/.*\.php$ + @storage-php path_regexp ^/storage/.*\.php(?:/|$) respond @storage-php 403 # Block access to files that may expose sensitive information