How to deny shell execution in all sub-directories?

Question

I want nginx to deny users who have folders inside /webroot/uploads

e.g.

/webroot/uploads/user1
/webroot/uploads/user2
/webroot/uploads/user999

to execute any shell (php, pl, py, binary).

The shells are often hidden in jpg or gif files. like badfile.php.jpg

I also see malacious binary files being uploaded to the folder.

Here my preliminary rules:

location ~ /webroot/uploads/(.+)\.php$ {
 deny all;
}

location ~ /webroot/uploads/(.+)\.pl$ {
 deny all;
}

But I am not sure it is robust enough. So I appreciate your help.

Answer 1

First of, make sure that you have the mime.types properly setup in your config file (http://wiki.nginx.org/FullExample#mime_types), so a foo.php.jpg is still treated as an image.

Also, use the tilde-asterisk (~*) instead of just the tilde (~), this will make your regex case insensitive (and thus prevent files like blah.pHP and evil.PHp, ...):

location ~* /webroot/uploads/(.+)\.php$ {
  deny all;
}

One approach you could take is to whitelist allowed extensions, and handle others. Since Nginx doesn't have a syntax for not matching an expression, you could "do nothing" when a match is found, and deny/redirect the rest

location ~* /webroot/uploads/(.+)\.(jpg|gif|png|mp3)$ {
  # empty block
}

# all other requests come here
location / {
  # redirect, deny, ...
}