gixy

Nginx configuration static analyzer

  • 所有者: yandex/gixy
  • 平台:
  • 許可證: Other
  • 分類:
  • 主題:
  • 喜歡:
    0
      比較:

Github星跟蹤圖

GIXY

Mozilla Public License 2.0
Build Status
Your feedback is greatly appreciated
GitHub issues
GitHub pull requests

Overview

Gixy is a tool to analyze Nginx configuration.
The main goal of Gixy is to prevent security misconfiguration and automate flaw detection.

Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7.

Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues.

What it can do

Right now Gixy can find:

You can find things that Gixy is learning to detect at Issues labeled with "new plugin"

Installation

Gixy is distributed on PyPI. The best way to install it is with pip:

pip install gixy

Run Gixy and check results:

gixy

Usage

By default Gixy will try to analyze Nginx configuration placed in /etc/nginx/nginx.conf.

But you can always specify needed path:

$ gixy /etc/nginx/nginx.conf

==================== Results ===================

Problem: [http_splitting] Possible HTTP-Splitting vulnerability.
Description: Using variables that can contain "\n" may lead to http injection.
Additional info: https://github.com/yandex/gixy/blob/master/docs/ru/plugins/httpsplitting.md
Reason: At least variable "$action" can contain "\n"
Pseudo config:
include /etc/nginx/sites/default.conf;

	server {

		location ~ /v1/((?<action>[^.]*)\.json)?$ {
			add_header X-Action $action;
		}
	}


==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 1

Or skip some tests:

$ gixy --skips http_splitting /etc/nginx/nginx.conf

==================== Results ===================
No issues found.

==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 0

Or something else, you can find all other gixy arguments with the help command: gixy --help

Docker usage

Gixy is available as a Docker image from the Docker hub. To
use it, mount the configuration that you want to analyse as a volume and provide the path to the
configuration file when running the Gixy image.

$ docker run --rm -v `pwd`/nginx.conf:/etc/nginx/conf/nginx.conf yandex/gixy /etc/nginx/conf/nginx.conf

If you have an image that already contains your nginx configuration, you can share the configuration
with the Gixy container as a volume.

$  docker run --rm --name nginx -d -v /etc/nginx
nginx:alpinef68f2833e986ae69c0a5375f9980dc7a70684a6c233a9535c2a837189f14e905

$  docker run --rm --volumes-from nginx yandex/gixy /etc/nginx/nginx.conf

==================== Results ===================
No issues found.

==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 0

Contributing

Contributions to Gixy are always welcome! You can help us in different ways:

  • Open an issue with suggestions for improvements and errors you're facing;
  • Fork this repository and submit a pull request;
  • Improve the documentation.

Code guidelines:

  • Python code style should follow pep8 standards whenever possible;
  • Pull requests with new plugins must have unit tests for it.

概覽

名稱與所有者yandex/gixy
主編程語言Python
編程語言Python (語言數: 4)
平台
許可證Other
發布數10
最新版本名稱v0.1.21 (發布於 )
第一版名稱v0.1.1 (發布於 )
創建於2017-03-15 01:02:40
推送於2024-01-06 11:38:28
最后一次提交2024-01-06 14:33:30
星數8.2k
關注者數156
派生數392
提交數130
已啟用問題?
問題數78
打開的問題數48
拉請求數52
打開的拉請求數4
關閉的拉請求數6
已啟用Wiki?
已存檔?
是復刻?
已鎖定?
是鏡像?
是私有?
去到頂部