@abtnode/router-provider 1.16.46-beta-20250703-024219-4029ee97 → 1.16.46-beta-20250703-050038-4ba2582f

package/lib/nginx/includes/security/crs4/rules/restricted-files.data

@@ -3,32 +3,53 @@
 .htaccess
 .htdigest
 .htpasswd
-# home level dotfiles (keep in sync with lfi-os-files.data)
-# grep -E '^\.' lfi-os-files.data
+# home level dotfiles (keep in sync with lfi-os-files.data).
+# Also include commented values (e.g., `# .env`), but not comments.
+# grep -E "^(#\s*)?\.\S+$" lfi-os-files.data | sed 's/^#\s*//'
 .addressbook
+.anydesk/
 .aptitude/config
+.atom/
 .aws/
 .azure/
 .bash_
 .bashrc
+.boto
 .cache/notify-osd.log
 .config/
 .cshrc
-.docker
+.cups/
+.dbus/
+.deployment-secrets.txt
+.docker/
 .drush/
 .env
+.envrc
 .eslintignore
 .fbcindex
 .forward
+.gem/
+.git/
 .gitattributes
 .gitconfig
+.gitignore
+.gitkeep
+.gitmodules
+.gnome/
+.gnome2/
+.gnomerc/
 .gnupg/
 .google_authenticator
+.gsutil/
+.hg/
+.hgignore
 .hplip/hplip.conf
 .htaccess
 .htdigest
 .htpasswd
+.java/
 .ksh_history
+.kube/
 .lesshst
 .lftp/
 .lhistory
@@ -36,13 +57,17 @@
 .lldb-history
 .local/share/mc/
 .lynx_cookies
+.minikube/
 .my.cnf
 .mysql_history
 .nano_history
+.netrc
 .node_repl_history
+.npm/
 .npmrc
 .nsconfig
 .nsr
+.nvm/
 .oh-my-
 .password-store
 .pearrc
@@ -64,44 +89,233 @@
 .snap/
 .ssh/
 .subversion/
+.svn/
+.svnignore
 .tconn/
 .tcshrc
 .tmux.conf
+.thunderbird/
 .tor/
+.travis.yaml
+.travis.yml
 .vagrant.d/
 .vidalia/
 .vim/
 .viminfo
 .vimrc
 .vscode
+.vmware/
 .www_acl
 .wwwacl
-.Xauthority
+.xauthority
 .yarnrc
+.zshenv
 .zhistory
 .zsh_history
-.zshenv
 .zshrc
-# Version control
-/.git/
-/.gitignore
-/.hg/
-/.hgignore
-/.svn/
+
+# Generic config filenames and common permutations
+config.asp
+config_dev.asp
+config-dev.asp
+config.dev.asp
+config_prod.asp
+config-prod.asp
+config.prod.asp
+config.sample.asp
+config-sample.asp
+config_sample.asp
+config_test.asp
+config-test.asp
+config.test.asp
+config.ini
+config_dev.ini
+config-dev.ini
+config.dev.ini
+config_prod.ini
+config-prod.ini
+config.prod.ini
+config.sample.ini
+config-sample.ini
+config_sample.ini
+config_test.ini
+config-test.ini
+config.test.ini
+config.json
+config_dev.json
+config-dev.json
+config.dev.json
+config_prod.json
+config-prod.json
+config.prod.json
+config.sample.json
+config-sample.json
+config_sample.json
+config_test.json
+config-test.json
+config.test.json
+config.php
+config_dev.php
+config-dev.php
+config.dev.php
+config_prod.php
+config-prod.php
+config.prod.php
+config.sample.php
+config-sample.php
+config_sample.php
+config_test.php
+config-test.php
+config.test.php
+config.pl
+config_dev.pl
+config-dev.pl
+config.dev.pl
+config_prod.pl
+config-prod.pl
+config.prod.pl
+config.sample.pl
+config-sample.pl
+config_sample.pl
+config_test.pl
+config-test.pl
+config.test.pl
+config.py
+config_dev.py
+config-dev.py
+config.dev.py
+config_prod.py
+config-prod.py
+config.prod.py
+config.sample.py
+config-sample.py
+config_sample.py
+config_test.py
+config-test.py
+config.test.py
+config.rb
+config_dev.rb
+config-dev.rb
+config.dev.rb
+config_prod.rb
+config-prod.rb
+config.prod.rb
+config.sample.rb
+config-sample.rb
+config_sample.rb
+config_test.rb
+config-test.rb
+config.test.rb
+config.toml
+config_dev.toml
+config-dev.toml
+config.dev.toml
+config_prod.toml
+config-prod.toml
+config.prod.toml
+config.sample.toml
+config-sample.toml
+config_sample.toml
+config_test.toml
+config-test.toml
+config.test.toml
+config.txt
+config_dev.txt
+config-dev.txt
+config.dev.txt
+config_prod.txt
+config-prod.txt
+config.prod.txt
+config.sample.txt
+config-sample.txt
+config_sample.txt
+config_test.txt
+config-test.txt
+config.test.txt
+config.xml
+config_dev.xml
+config-dev.xml
+config.dev.xml
+config_prod.xml
+config-prod.xml
+config.prod.xml
+config.sample.xml
+config-sample.xml
+config_sample.xml
+config_test.xml
+config-test.xml
+config.test.xml
+config.yaml
+config_dev.yaml
+config-dev.yaml
+config.dev.yaml
+config_prod.yaml
+config-prod.yaml
+config.prod.yaml
+config.sample.yaml
+config-sample.yaml
+config_sample.yaml
+config_test.yaml
+config-test.yaml
+config.test.yaml
+config.yml
+config_dev.yml
+config-dev.yml
+config.dev.yml
+config_prod.yml
+config-prod.yml
+config.prod.yml
+config.sample.yml
+config-sample.yml
+config_sample.yml
+config_test.yml
+config-test.yml
+config.test.yml
+# Compressed database dumps
+.sql.001
+.sql.7z
+.sql.bz
+.sql.ace
+.sql.arj
+.sql.cpio
+.sql.gz
+.sql.lha
+.sql.lz
+.sql.pa
+.sql.pea
+.sql.r00
+.sql.r01
+.sql.r02
+.sql.r03
+.sql.r04
+.sql.r05
+.sql.r06
+.sql.r07
+.sql.r08
+.sql.r09
+.sql.rar
+.sql.rev
+.sql.tar
+.sql.taz
+.sql.tbz
+.sql.tgz
+.sql.txz
+.sql.uha
+.sql.xz
+.sql.yz1
+.sql.z
+# AWS cli
+aws.yaml
+aws.yml
+aws-key.yaml
+aws-key.yml
 # October CMS credentials file
 /auth.json
 # Wordpress
-wp-config.php
-wp-config.bak
-wp-config.old
-wp-config.temp
-wp-config.tmp
-wp-config.txt
+wp-config.
+wp-config-
+wp-config_
 # Symfony
-/config/config.yml
-/config/config_dev.yml
-/config/config_prod.yml
-/config/config_test.yml
 /config/parameters.yml
 /config/routing.yml
 /config/security.yml
@@ -110,15 +324,11 @@ wp-config.txt
 /sites/default/default.settings.php
 /sites/default/settings.php
 /sites/default/settings.local.php
-# NextCloud
-/config/config.php
 # PrestaShop configuration files
 /config/settings.inc.php
 /app/config/parameters.php
 # Magento
 /app/etc/local.xml
-# Sublime Text
-/sftp-config.json
 # ASP.NET
 /Web.config
 # Node
@@ -127,8 +337,6 @@ wp-config.txt
 /npm-shrinkwrap.json
 /gruntfile.js
 /npm-debug.log
-/ormconfig.json
-/tsconfig.json
 /webpack.config.js
 /yarn.lock
 # Composer
@@ -148,6 +356,7 @@ bower.json
 .jshintrc
 .gitlab-ci.yml
 .travis.yml
+database.yaml
 database.yml
 Dockerfile
 # PHP_CodeSniffer configuration files
@@ -165,8 +374,6 @@ Thumbs.db
 php.ini
 # Oracle WebLogic Server configuration file
 weblogic.xml
-# Oracle SOAP Request Handler configuration file
-soapConfig.xml
 # Common names for local PHP error logs
 php_error.log
 php_errors.log
@@ -185,6 +392,20 @@ sendgrid.env
 # Fish shell files
 .fish
 fish_variables
+# CVE-2023-5003
+ldap-authentication-report.csv
+# OpenStack-Ansible credentials file
+user_secrets.yml
+# File used by Visual Studio to store sensitive data
+secrets.json
+# Docker definition files, first two are commented out
+# as they are matched by the rest of the files
+#docker-compose.yml
+#docker-compose.yaml
+compose.yml
+compose.yaml
+# CVE-2023-49103
+phpinfo.php
 
 # /proc entries (keep in sync with lfi-os-files.data)
 # grep -E "^proc/" lfi-os-files.data

package/lib/nginx/includes/security/crs4/rules/restricted-upload.data

@@ -5,29 +5,36 @@
 # w
 # q
 # EOF
-# words="$(awk ' !/^#/ {split($0, segments, "/")} {word = segments[length(segments)]} length(word) > 3 {print word}' rules/restricted-files.data | \
-#   sort | uniq)"
+# words="$(awk ' !/^#/ && NF {
+#  n = split($0, segments, "/");
+#  word = segments[n];
+#  if (length(word) > 3) print word
+# }' rules/restricted-files.data | sort | uniq)"
 # while read -r word; do
 #   if [ "$(util/fp-finder/spell.sh -m -e - <<<"${word}")" != "${word}" ]; then
 #     echo "${word}" >> rules/restricted-upload.data
 #   fi
 # done <<<"${words}"
-
-.DS_Store
 .addressbook
 .bash_
 .bashrc
+.boto
 .bowerrc
 .cshrc
-.docker
+.deployment-secrets.txt
+.DS_Store
 .env
+.envrc
 .eslintignore
 .eslintrc
 .fbcindex
+.fish
 .forward
 .gitattributes
 .gitconfig
 .gitignore
+.gitkeep
+.gitmodules
 .gitlab-ci.yml
 .google_authenticator
 .hgignore
@@ -45,7 +52,9 @@
 .my.cnf
 .mysql_history
 .nano_history
+.netrc
 .node_repl_history
+.npmrc
 .nsconfig
 .nsr
 .oh-my-
@@ -65,50 +74,216 @@
 .rediscli_history
 .rhistory
 .rhosts
+.selected_editor
 .sh_history
 .sqlite_history
+.svnignore
 .tcshrc
+.tmux.conf
+.travis.yaml
 .travis.yml
 .user.ini
 .viminfo
 .vimrc
+.vscode
 .ws_ftp.ini
 .www_acl
 .wwwacl
 .xauthority
+.yarnrc
 .zhistory
 .zsh_history
+.zshenv
 .zshrc
-Desktop.ini
-Dockerfile
-Thumbs.db
-Web.config
+# Generic config filenames and common permutations
+config.asp
+config_dev.asp
+config-dev.asp
+config.dev.asp
+config_prod.asp
+config-prod.asp
+config.prod.asp
+config.sample.asp
+config-sample.asp
+config_sample.asp
+config_test.asp
+config-test.asp
+config.test.asp
+config.ini
+config_dev.ini
+config-dev.ini
+config.dev.ini
+config_prod.ini
+config-prod.ini
+config.prod.ini
+config.sample.ini
+config-sample.ini
+config_sample.ini
+config_test.ini
+config-test.ini
+config.test.ini
+config.json
+config_dev.json
+config-dev.json
+config.dev.json
+config_prod.json
+config-prod.json
+config.prod.json
+config.sample.json
+config-sample.json
+config_sample.json
+config_test.json
+config-test.json
+config.test.json
+config.php
+config_dev.php
+config-dev.php
+config.dev.php
+config_prod.php
+config-prod.php
+config.prod.php
+config.sample.php
+config-sample.php
+config_sample.php
+config_test.php
+config-test.php
+config.test.php
+config.pl
+config_dev.pl
+config-dev.pl
+config.dev.pl
+config_prod.pl
+config-prod.pl
+config.prod.pl
+config.sample.pl
+config-sample.pl
+config_sample.pl
+config_test.pl
+config-test.pl
+config.test.pl
+config.py
+config_dev.py
+config-dev.py
+config.dev.py
+config_prod.py
+config-prod.py
+config.prod.py
+config.sample.py
+config-sample.py
+config_sample.py
+config_test.py
+config-test.py
+config.test.py
+config.rb
+config_dev.rb
+config-dev.rb
+config.dev.rb
+config_prod.rb
+config-prod.rb
+config.prod.rb
+config.sample.rb
+config-sample.rb
+config_sample.rb
+config_test.rb
+config-test.rb
+config.test.rb
+config.toml
+config_dev.toml
+config-dev.toml
+config.dev.toml
+config_prod.toml
+config-prod.toml
+config.prod.toml
+config.sample.toml
+config-sample.toml
+config_sample.toml
+config_test.toml
+config-test.toml
+config.test.toml
+config.txt
+config_dev.txt
+config-dev.txt
+config.dev.txt
+config_prod.txt
+config-prod.txt
+config.prod.txt
+config.sample.txt
+config-sample.txt
+config_sample.txt
+config_test.txt
+config-test.txt
+config.test.txt
+config.xml
+config_dev.xml
+config-dev.xml
+config.dev.xml
+config_prod.xml
+config-prod.xml
+config.prod.xml
+config.sample.xml
+config-sample.xml
+config_sample.xml
+config_test.xml
+config-test.xml
+config.test.xml
+config.yaml
+config_dev.yaml
+config-dev.yaml
+config.dev.yaml
+config_prod.yaml
+config-prod.yaml
+config.prod.yaml
+config.sample.yaml
+config-sample.yaml
+config_sample.yaml
+config_test.yaml
+config-test.yaml
+config.test.yaml
+config.yml
+config_dev.yml
+config-dev.yml
+config.dev.yml
+config_prod.yml
+config-prod.yml
+config.prod.yml
+config.sample.yml
+config-sample.yml
+config_sample.yml
+config_test.yml
+config-test.yml
+config.test.yml
 acpi
 asound
 auth.json
+aws.yaml
+aws.yml
+aws-key.yaml
+aws-key.yml
+BlockCypher.log
 bootconfig
 bower.json
 buddyinfo
 cgroups
 cmdline
+compose.yaml
+compose.yml
 composer.json
 composer.lock
 config.gz
 config.inc.php
-config.php
 config.sample.php
-config.yml
-config_dev.yml
-config_prod.yml
-config_test.yml
 cpuinfo
+database.yaml
 database.yml
-defaults.inc.php
 default.settings.php
+defaults.inc.php
+Desktop.ini
 diskstats
+Dockerfile
 dynamic_debug
 execdomains
 filesystems
+fish_variables
 gruntfile.js
 hplip.conf
 hypervisor
@@ -123,6 +298,7 @@ kpagecgroup
 kpagecount
 kpageflags
 latency_stats
+ldap-authentication-report.csv
 loadavg
 local.xml
 mdstat
@@ -131,47 +307,45 @@ mtrr
 notify-osd.log
 npm-debug.log
 npm-shrinkwrap.json
-ormconfig.json
 package-lock.json
 package.json
 packages.json
 pagetypeinfo
 parameters.php
 parameters.yml
-php.ini
 php_error.log
 php_errors.log
+php.ini
 phpcs.xml
 phpcs.xml.dist
 routing.yml
 sched_debug
 schedstat
+secrets.json
 security.yml
+sendgrid.env
 services.yml
 settings.inc.php
 settings.local.php
 settings.php
-sftp-config.json
 slabinfo
-soapConfig.xml
 softirqs
 sslvpn_websession
 sysrq-trigger
 sysvipc
 thread-self
+Thumbs.db
 timer_list
 timer_stats
-tsconfig.json
+user_secrets.yml
 version_signature
 vmallocinfo
 vmstat
+Web.config
 weblogic.xml
 webpack.config.js
-wp-config.bak
-wp-config.old
-wp-config.php
-wp-config.temp
-wp-config.tmp
-wp-config.txt
+wp-config.
+wp-config-
+wp-config_
 yarn.lock
 zoneinfo