Jamie Curnow
66ab4b24d1
advanced_config is admin-only, but other fields are written into nginx
config as-is and the schema barely limited them. A non-admin could add
any directive through them:
- location path, forward_host and forward_path (any non-empty string)
- proxy host forward_host (a quote breaks out of set $server "...")
- redirection forward_domain_name and stream forwarding_host (their
pattern allowed ";", e.g. "example.com; return 200; #")
- access list IPv6 addresses ("%.+" zone id allowed "::1%x; allow all")
- domain names (a newline got out of the header comment)
Validation
- New lib/nginx-values.js holds the rules. Values can't contain
characters that end or change an nginx token: whitespace, control
characters, ; { } " ' # \, and no $ in a host. Location paths allow a
modifier and an unquoted or double-quoted URI, so =, ~, ~* and ^~
locations and quoted regexes keep working.
- The API schemas use the same patterns, including the certificate
schema's own copy of the domain rule. A test fails if they drift.
- generateConfig checks stored values again, so rows saved before these
rules can't inject either. The check is about nginx structure only:
a stored value the API would now reject, but which can't add
directives, still renders. If a value is unsafe, nothing is written
and the host is marked offline with the reason in nginx_err. The same
check covers per-location access lists and the Let's Encrypt request
config.
- htpasswd user names can't contain ":" or control characters, which
corrupted the file.
Fixes along the way
- IPv6 client addresses: drop zone ids, which nginx's allow/deny
rejects anyway, and fix broken escapes (literal "d" for digits, an
unescaped ".").
- Rewrite the domain rule used by redirection and stream hosts so it
can't backtrack exponentially. It accepts the same values.
- Pattern errors still say "must match pattern", but no longer quote
the regex.
Tests
- backend/test/nginx-values.test.js, run by `yarn test` and in
scripts/ci/test-and-build. Real request schemas reject an injection
set and accept valid values on every endpoint. Accepted values,
rendered through the real templates and parsed using nginx's
tokenizer rules, keep the same statement structure. The check
refuses unsafe stored rows.
- NginxValues.cy.js: injection attempts from a non-admin get 400, and
hosts using valid edge-case values come up with nginx_online true.
Cypress Test Suite
Host Header Regression Test
Run python3 test/host-header-smoke.py <built-image> from the repository root.
The backend CI build runs this check against the image it builds. It creates a
disposable NPM container and renders a proxy host through the backend's normal
configuration generator, including a custom location. A synthetic HTTPS upstream
checks that the forwarded Host matches Origin and Referer, and echoes the request
method, path and body. Coverage includes HTTP and HTTPS, explicit default and
nonstandard ports, mixed-case names, IPv6 authorities, and HTTP/1.0 without Host.
All test traffic and published Docker ports use loopback; the container and its
anonymous volumes are removed on completion.
Running Locally
cd nginxproxymanager/test
yarn install
yarn run cypress
VS Code
Editor settings are not committed to the repository, typically because each developer has their own settings. Below is a list of common setting that may help, so feel free to try them or ignore them, you are a strong independent developer. You can add settings to either "user" or "workspace" but we recommend using "workspace" as each project is different.
ESLint
The ESLint extension only works on JavaScript files by default, so add the following to your workspace settings and reload VSCode.
"eslint.autoFixOnSave": true,
"eslint.validate": [
{ "language": "javascript", "autoFix": true },
"html"
]
NOTE: If you've also set the editor.formatOnSave option to true in your settings.json, you'll need to add the following config to prevent running 2 formatting commands on save for JavaScript and TypeScript files:
"editor.formatOnSave": true,
"[javascript]": {
"editor.formatOnSave": false,
},
"[javascriptreact]": {
"editor.formatOnSave": false,
},
"[typescript]": {
"editor.formatOnSave": false,
},
"[typescriptreact]": {
"editor.formatOnSave": false,
},
Forwarded Host image test
Run python3 test/host-header-smoke.py <built-image> from the repository root.
The test waits for the manager, generated HTTP/HTTPS proxy host, both location
paths and its synthetic upstream. It verifies Host/Origin/Referer consistency,
request bodies and HTTP/1.0 fallback, then uses a dynamic upstream counter to
prove cache hits and isolation between client authorities on ports 232 and 233.
Requests run through docker exec, so a remote Docker daemon or containerized
CI agent needs no shared loopback interface or published ports. The CI image
build script invokes this test against the image it just built.