{"action":"created","issue":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/339","repository_url":"https://api.github.com/repos/nbs-system/naxsi","labels_url":"https://api.github.com/repos/nbs-system/naxsi/issues/339/labels{/name}","comments_url":"https://api.github.com/repos/nbs-system/naxsi/issues/339/comments","events_url":"https://api.github.com/repos/nbs-system/naxsi/issues/339/events","html_url":"https://github.com/nbs-system/naxsi/issues/339","id":197257256,"number":339,"title":"Question | Directory URL / formats allowing access only (whitelist approach)","user":{"login":"C0nw0nk","id":12204587,"avatar_url":"https://avatars.githubusercontent.com/u/12204587?v=3","gravatar_id":"","url":"https://api.github.com/users/C0nw0nk","html_url":"https://github.com/C0nw0nk","followers_url":"https://api.github.com/users/C0nw0nk/followers","following_url":"https://api.github.com/users/C0nw0nk/following{/other_user}","gists_url":"https://api.github.com/users/C0nw0nk/gists{/gist_id}","starred_url":"https://api.github.com/users/C0nw0nk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/C0nw0nk/subscriptions","organizations_url":"https://api.github.com/users/C0nw0nk/orgs","repos_url":"https://api.github.com/users/C0nw0nk/repos","events_url":"https://api.github.com/users/C0nw0nk/events{/privacy}","received_events_url":"https://api.github.com/users/C0nw0nk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-12-22T20:11:02Z","updated_at":"2016-12-23T11:05:05Z","closed_at":null,"body":"So here is a rule I would like to try and make possible it is just a bit complex to get down on my own.\r\n\r\nExample URL formats to be whitelisted while denying all the others\r\n```\r\n/url/url\r\n/url/url/\r\n/url/url.html\r\n/url\r\n/url&args\r\n/url?args&moreargs=lol\r\n/url/index\r\n/index.html\r\n/url/index.html\r\n/index.php\r\n/index.php?args&search=lol\r\n/index.html?args\r\n/url.html?args&search=lol\r\nurl/url.html?args&search=lol\r\n/url/url.html?args&search=lol\r\n```\r\n\r\nI guess if it is not a php, html or a / link to disallow it. (No reason why people should be trying to access url formats and directories that are not accepted / don't exist.)\r\n\r\nThe reason the URL's are like this is because some are SEF (search engine friendly) URL's while others are not.\r\n\r\nWhat I came up with so far.\r\n```\r\nMainRule negative \"rx:\\.(html|php)\" \"msg:Block access to any URL format other than those whitelisted\" \"mz:URL\" \"s:$UWA:8\" id:1600;\r\n```\r\n\r\nUnfortunately this rule won't be to friendly since \".php5\" \".htmlanything\" etc will be accepted even though they don't exist and should be blocked, I also believe this won't like url's that don't contain the .php or .html format so a non existent file type like the following example.\r\n```\r\n/url/\r\n/\r\n/url\r\n/url&args\r\n/url?args\r\n```\r\nThose will be blocked when I want them allowed.\r\n\r\nAny help / advice is much appreciated <3 :) It might be impossible."},"comment":{"url":"https://api.github.com/repos/nbs-system/naxsi/issues/comments/268974193","html_url":"https://github.com/nbs-system/naxsi/issues/339#issuecomment-268974193","issue_url":"https://api.github.com/repos/nbs-system/naxsi/issues/339","id":268974193,"user":{"login":"C0nw0nk","id":12204587,"avatar_url":"https://avatars.githubusercontent.com/u/12204587?v=3","gravatar_id":"","url":"https://api.github.com/users/C0nw0nk","html_url":"https://github.com/C0nw0nk","followers_url":"https://api.github.com/users/C0nw0nk/followers","following_url":"https://api.github.com/users/C0nw0nk/following{/other_user}","gists_url":"https://api.github.com/users/C0nw0nk/gists{/gist_id}","starred_url":"https://api.github.com/users/C0nw0nk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/C0nw0nk/subscriptions","organizations_url":"https://api.github.com/users/C0nw0nk/orgs","repos_url":"https://api.github.com/users/C0nw0nk/repos","events_url":"https://api.github.com/users/C0nw0nk/events{/privacy}","received_events_url":"https://api.github.com/users/C0nw0nk/received_events","type":"User","site_admin":false},"created_at":"2016-12-23T11:05:05Z","updated_at":"2016-12-23T11:05:05Z","body":"Thanks :D wouldn't that be a separate rule how do I combine both of them into a single rule ? <3\r\n\r\n```\r\nMainRule negative \"rx:\\.(html|php)$\" \"msg:Block access to any URL format other than those whitelisted\" \"mz:URL\" \"s:$UWA:8\" id:1600;\r\nMainRule negative \"rx:^/[a-z/]+/$\" \"msg:Block access to any URL format other than those whitelisted\" \"mz:URL\" \"s:$UWA:8\" id:1600;\r\n```\r\n\r\nI am still learning but this place helps allot. http://spike.nginx-goodies.com/rules/"}}
{"actor":{"display_login":"C0nw0nk"}}