nginx/gixy
Checks every nginx file for mistakes that expose a server: request forgery, path traversal through alias, header injection, and a disclosed version.
Part of the nginx configuration, at the recommended level. It runs at the commit stage, per file. It runs gixy.
These mistakes parse, serve traffic, and look like any other location block until somebody uses them.
What to do
Section titled “What to do”Change the block the way the rule page says. Turn one rule off with gspot ignore nginx/gixy --rule <name> --reason "<why>".
Example
Section titled “Example”A location for /proxy/(.*) with proxy_pass http://$1 sends requests to any host and reports ssrf. Point proxy_pass at a fixed upstream instead.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore nginx/gixy --paths "<glob>" --reason "<why>"gspot ignore nginx/gixy --rule <rule> --reason "<why>"