Nginx configuration static analyzer

Andrew Krasichkov 285e20fe5e More test cases for if parsing 7 years ago
docs e947fd16b4 #65: Fixed origin regex in documentation 7 years ago
gixy b93a60d09c Better if condition parsing 7 years ago
rpm f5fd81c0db Version bump to 0.1.5 7 years ago
tests 285e20fe5e More test cases for if parsing 7 years ago
.dockerignore 3fcc7f7eae Added dockerignore 7 years ago
.editorconfig 7d182dbdba Added editorconfig 7 years ago
.gitignore 65a4b846fa Added RPM specs 7 years ago
.travis.yml d4e3d5285e Test on PyPy 2 and 3 7 years ago
AUTHORS 2ff6ac1f8b Initial commit 7 years ago
CONTRIBUTING.md e50cc9b532 Replace CONTRIBUTING.md 7 years ago
Dockerfile 85d075e3ec Rebase docker image on python:2.7-alpine 7 years ago
LICENSE 2ff6ac1f8b Initial commit 7 years ago
MANIFEST.in 2ff6ac1f8b Initial commit 7 years ago
Makefile acf5039863 Added makefile 7 years ago
README.RU.md f225f9a8fb Minor readme improvements 7 years ago
README.md 7360ee0adb Document Docker usage 7 years ago
requirements.dev.txt f7de6bf6ff Added tox to dev dependencies 7 years ago
requirements.txt 6d0e66e6a7 Resolve #12: renamed requirements*.pip to requirements*.txt 7 years ago
setup.py f5a30e2e70 Minor improvements 7 years ago
tox.ini 39fa26c7fe Added basic Python 2.6 support (#43) 7 years ago

README.RU.md

GIXY

Mozilla Public License 2.0 Build Status Your feedback is greatly appreciated GitHub issues GitHub pull requests

Overview

Gixy — это утилита для анализа конфигурации Nginx. Большей частью служит для обнаружения проблем безопасности, но может искать и иные ошибки.

Официально поддерживаются версии Python 2.7, 3.5 и 3.6

 

Что умеет

На текущий момент Gixy способна обнаружить:

Проблемы, которым Gixy только учится можно найти в Issues с меткой "new plugin"

Установка

Наиболее простой способ установки Gixy - воспользоваться pip для установки из PyPI:

pip install gixy

Использование

После установки должна стать доступна консольная утилита gixy. По умолчанию Gixy ищет конфигурацию по стандартному пути /etc/nginx/nginx.conf, однако вы можете указать специфичное расположение:

$ gixy /etc/nginx/nginx.conf

==================== Results ===================

Problem: [http_splitting] Possible HTTP-Splitting vulnerability.
Description: Using variables that can contain "\n" may lead to http injection.
Additional info: https://github.com/yandex/gixy/wiki/ru/httpsplitting
Reason: At least variable "$action" can contain "\n"
Pseudo config:
include /etc/nginx/sites/default.conf;

	server {

		location ~ /v1/((?<action>[^.]*)\.json)?$ {
			add_header X-Action $action;
		}
	}


==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 1

Gixy умеет обрабатывать директиву include и попробует максимально корректно обработать все зависимости, если что-то пошло не так можно попробовать запустить gixy с флагом -d для вывода дополнительной информации. Все доступные опции:

$ gixy -h
usage: gixy [-h] [-c CONFIG_FILE] [--write-config CONFIG_OUTPUT_PATH]
            [-v] [-l] [-f {console,text,json}] [-o OUTPUT_FILE] [-d]
            [--tests TESTS] [--skips SKIPS] [--disable-includes]
            [--origins-domains domains]
            [--origins-https-only https_only]
            [--add-header-redefinition-headers headers]
            [nginx.conf]

Gixy - a Nginx configuration [sec]analyzer

positional arguments:
  nginx.conf            Path to nginx.conf, e.g. /etc/nginx/nginx.conf

optional arguments:
  -h, --help            show this help message and exit
  -c CONFIG_FILE, --config CONFIG_FILE
                        config file path
  --write-config CONFIG_OUTPUT_PATH
                        takes the current command line args and writes them
                        out to a config file at the given path, then exits
  -v, --version         show program's version number and exit
  -l, --level           Report issues of a given severity level or higher (-l
                        for LOW, -ll for MEDIUM, -lll for HIGH)
  -f {console,text,json}, --format {console,text,json}
                        Specify output format
  -o OUTPUT_FILE, --output OUTPUT_FILE
                        Write report to file
  -d, --debug           Turn on debug mode
  --tests TESTS         Comma-separated list of tests to run
  --skips SKIPS         Comma-separated list of tests to skip
  --disable-includes    Disable "include" directive processing

plugins options:
  --origins-domains domains
                        Default: *
  --origins-https-only https_only
                        Default: False
  --add-header-redefinition-headers headers
                        Default: content-security-policy,x-xss-
                        protection,x-frame-options,x-content-type-
                        options,strict-transport-security,cache-control


available plugins:
	host_spoofing
	add_header_multiline
	http_splitting
	valid_referers
	origins
	add_header_redefinition
	ssrf

Contributing

Contributions to Gixy are always welcome! You can help us in different ways:

  • Open an issue with suggestions for improvements and errors you're facing;
  • Fork this repository and submit a pull request;
  • Improve the documentation.

Code guidelines:

  • Python code style should follow pep8 standards whenever possible;
  • Pull requests with new plugins must have unit tests for it.