1

The Drupal Nginx recipe doesn't block access to extensionless files (such as files named "LICENSE"), and it also allows access to LICENSE.md and other files that can be checked to see what modules are in use on a Drupal site.

As an example, if I have a running Drupal site and in my browser go to mydrupalsite.example.com/modules/contrib/ckeditor/vendor/LICENSE.md, and a file is downloaded, I know that the CKEdtior 4 contrib module is used. By checking files of popular modules like this, and checking the content of the files, someone could try to figure out specific versions of modules on Drupal sites, looking for vulnerable versions.

The best solution is to keep everything up-to-date, of course. Still, I'm wondering if the Drupal Nginx recipe can be improved to mitigate this method of finding what modules and dependencies are used, without blocking access to markdown files that have been uploaded to the site, as I want to support that.

Specifically, I want to block access to extensionless files altogether, as well as markdown files that come with the installed modules/dependencies and weren't uploaded by users.

1 Answer 1

2

One way to "block access" is to delete the files. I know you asked about how to block the files with nginx, so consider this an indirect answer to your question.

In my CD pipeline, I have a bash script, clean-repo-for-cloud.sh. I execute this script every build to delete the unnecessary files from my deploy images.

Here's the relevant part of my script:

#!/bin/bash

# Show every command with variables expanded for debugging.
# set -x
# Abort on failure.
set -eo pipefail

# Set the script directory.
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
# Change to the script directory so that relative paths work.
cd "$SCRIPT_DIR" || exit

git_root="$SCRIPT_DIR/../../"
drupal_core_path="$git_root/web/core"

function remove_unnecessary_drupal_files {
  # Delete Drupal test directories.
  # https://unix.stackexchange.com/a/89937
  find . -type d -name tests -exec rm -rf {} +
  # Delete testing and demo profiles.
  drupal_core_profiles_path="$drupal_core_path/profiles"
  # Use -print to show what is deleted.
  find "$drupal_core_profiles_path" -type d -name 'testing*' -exec rm -rf {} +
  # find "$drupal_core_profiles_path" -type d -name 'testing*' -exec rm -rf {} + -print
  find "$drupal_core_profiles_path" -type d -name 'nightwatch_testing' -exec rm -rf {} +
  # find "$drupal_core_profiles_path" -type d -name 'nightwatch_testing' -exec rm -rf {} + -print
  find "$drupal_core_profiles_path" -type d -name 'demo_umami' -exec rm -rf {} +
  # find "$drupal_core_profiles_path" -type d -name 'demo_umami' -exec rm -rf {} + -print
  # Delete README files.
  find . -type f -name 'README*' -delete
  # find . -type f -name 'README*' -delete -print
  find . -type f -name 'CHANGELOG*' -delete
  # find . -type f -name 'CHANGELOG*' -delete -print
  # Delete patch records.
  find . -type f -name 'PATCHES.txt' -delete
  # find . -type f -name 'PATCHES.txt' -delete -print
  # Delete markdown files except licenses.
  find web -type f -name "*.md" -not -name "LICENSE*" -delete
  # find web -type f -name "*.md" -not -name "LICENSE*" -delete -print
  # Delete txt files except licenses.
  find web -type f -name "*.txt" -not -name "LICENSE*" -not -name "COPYRIGHT*" -delete
  # find web -type f -name "*.txt" -not -name "LICENSE*" -not -name "COPYRIGHT*" -delete -print

}

remove_unnecessary_drupal_files

In your case, you would want to delete the licenses, too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.