tengine无法解析ssi报错 Nginx: unsafe URI detected while sending response
Nginx: unsafe URI detected while sending response 现象：# 类似 <!--#include virtual="../library/header.html"--><div id="blog"> html语法无法解析，导致网站头部尾部不能正常展示 <!--#include virtual="library/header.html"--> 可以解析没有问题 # 代码片段
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1.0">
<link rel="shortcut icon" href="http://blog.chinasoft.com/static/favicon.ico" />
<title>Influencer Marketing Tips</title>
<meta name="description" content="Learn more about the helpful influencer marketing tips for your brand, products or business on chinasoft blog center." />
</head>
<body> <!--#include virtual="../library/header.html"--><div id="blog">
<div>
<div class="container py-lg-5" style="max-width:1200px">
<div class="bg-light rounded py-4 px-5 mx-auto"> 网站头部不能加载影响美观 [root@eus_mp_web01:/data/www/vhosts/blog.chinasoft.com/httpdocs/influencer-marketing-tips]# tail -f /data/www/logs/nginx_log/error/blog.com_error.log
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * open() "/data/www/vhosts/blog.chinasoft.com/httpdocs/static/favicon.ico" failed (: No such file or directory), client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /static/favicon.ico HTTP/1.1", host: "blog.chinasoft.com", referrer: "https://blog.chinasoft.com/influencer-marketing-tips/"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/header.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/header.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/header.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/header.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com" // :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/header.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com"
// :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com" 关于Nginx的SSI(包含路径)
如果shtml里面的网页代码包含语句写成如下：
<!--#include virtual="/test.html"-->
这样是没有问题，可以包含的，但是如果写成这样： <!--#include virtual="../test.html"-->
由于需要包含当前代码文件所在目录路径的上级目录文件，nginx会为此请求产生的子请求uri为/../test.html，默认nginx会认为这个uri并不是安全的，日志(error_log)会输入如下错误： // :: [error] #: * unsafe URI "/influencer-marketing-tips/../library/footer.html" was detected while sending response to client, client: 1.1.1.1, server: blog.chinasoft.com, request: "GET /influencer-marketing-tips/ HTTP/1.1", host: "blog.chinasoft.com" 不能正确包含文件，页面会输出[an error occurred while processing the directive]，解决方法是找到nginx源代码目录的unsafe uri检查函数并强制使其返回一个NGX_OK # 解决办法： # 修改源文件tengine-2.2./src/http/ngx_http_parse.c
# 找到ngx_http_parse_unsafe_uri 函数，直接返回 NGX_OK ngx_http_parse_unsafe_uri(ngx_http_request_t *r, ngx_str_t *uri,
ngx_str_t *args, ngx_uint_t *flags)
{
return NGX_OK; # 新增return NGX_OK;
u_char ch, *p, *src, *dst;
size_t len;
ngx_uint_t quoted; len = uri->len;
p = uri->data;
quoted = ; if (len == || p[] == '?') {
goto unsafe;
} if (p[] == '.' && len > && p[] == '.'
&& (len == || ngx_path_separator(p[])))
{
goto unsafe;
} for ( /* void */ ; len; len--) { ch = *p++; if (ch == '%') {
quoted = ;
continue;
} if (usual[ch >> ] & ( << (ch & 0x1f))) {
continue;
} if (ch == '?') {
args->len = len - ;
args->data = p;
uri->len -= len; break;
} # 重新编译即可 ./configure --prefix=/usr/local/tengine-2.2.3_ssi --with-ld-opt=-Wl,-rpath, --user=daemon --group=daemon --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_xslt_module --with-http_sub_module --with-http_stub_status_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gzip_static_module --with-http_geoip_module --with-http_secure_link_module --with-http_degradation_module --with-mail_ssl_module --with-http_sysguard_module --with-http_concat_module --with-pcre=/usr/local/lab/pcre-8.34 --with-zlib=/usr/local/lab/zlib-1.2. --add-module=/usr/local/lab/ngx_cache_purge-2.3 --with-jemalloc --with-http_upstream_check_module --with-http_lua_module --with-luajit-lib=/usr/local/lib/ --with-luajit-inc=/usr/local/include/luajit-2.0/ --with-lua-inc=/usr/local/include/luajit-2.0/ --with-lua-lib=/usr/local/lib/ --with-openssl=/usr/local/lab/openssl-1.1.0i --add-module=/usr/local/ngx_http_geoip2_module-3.2 # make && make install 重新编译以后nginx可以包含上级目录的文件，当然，带来的后果是安全性的下降
tengine无法解析ssi报错 Nginx: unsafe URI detected while sending response的更多相关文章
- 【spring boot】spring boot 前台GET请求，传递时间类型的字符串，后台无法解析，报错：Failed to convert from type [java.lang.String] to type [java.util.Date]
spring boot 前台GET请求,传递时间类型的字符串,后台无法解析,报错:Failed to convert from type [java.lang.String] to type [jav ...
- golang解析json报错：invalid character '\x00' after top-level value
golang解析json报错:invalid character '\x00' after top-level value 手动复制字符串:{"files":["c:/t ...
- Nginx配置SSL报错 nginx: [emerg] unknown directive "ssl"
Nginx配置SSL报错 nginx: [emerg] unknown directive "ssl" 出现如图所示错误,处理办法如下 去nginx解压目录下执行 ./co ...
- nginx报错 nginx: [alert] kill(25903, 1) failed (3: No such process)
当nginx 中报错 时 nginx报错 nginx: [alert] kill(25903, 1) failed (3: No such process) 通过在nginx/sbin,目录下 运行命 ...
- cinder-volume报错vmdk2 is reporting problems, not sending heartbeat. Service will appear "down".
cinder-volume报错vmdk2 is reporting problems, not sending heartbeat. Service will appear "down&qu ...
- DOM解析XML报错：Content is not allowed in prolog
报错内容为: Content is not allowed in prolog. Nested exception: Content is not allowed in prolog. 网上所述总结来 ...
- freemarker解析模板报错问题
在确定模板文件代码无误的情况下,导致报错的原因大概有以下原因: 模板文件编码改变了(比如eclipse中的项目部署到tomcat下,而忘记设置tomcat编码就会导致读取模板文件编码不正确,导致程序解 ...
- 当html中存在url中如: onclick="toView('参数1')"， 参数1是特别字符，如&asop;"' "等时，浏览器解析时会报错。解决方法如文中描述
解决方案: 自定义标签将字符串转换成unicode编码后输出显示到页面即可 解析原理:解析顺序html ---url ----javascript---url,由于unicode编码在htm解析阶段 ...
- RobotFramework中解析中文报错UnicodeDecodeError
在RobotFramework中解析一段包含中文的字符串时遇到下面的报错: FAIL : UnicodeDecodeError: 'ascii' codec can't decode byte 0xe ...
随机推荐
- SpringCloud学习心得之Eureka注册中心的基本使用
SpringCloud学习心得——Eureka注册中心 示范代码链接 定义 SpringCloud Eureka是 SpringCloud Netflix微服务套件的一部分,基于 REST 的服务 ...
- ：Spring-06 -AOP [面向切面编程] -配置异常通知的两种方式--AspectJ 方式 -Schema-based 方式
三.配置异常通知的步骤(AspectJ 方式) 1.只有当切点报异常才能触发异常通知 2.在spring 中有AspectJ 方式提供了异常通知的办法 3.实现步骤: 3.1新建类,在类写任意名称的方 ...
- 关于ServletContext的私有方法全局获取返回null问题getServletContext().setAttribute("count", 1)
1.在Servlet重写了init方法中获取getServletContext()报错提示为空指针 重写了init(ServletConfig)方法,但是重写的init方法内部没有调用super.in ...
- java设计模式解析(1) Observer观察者模式
设计模式系列文章 java设计模式解析(1) Observer观察者模式 java设计模式解析(2) Proxy代理模式 java设计模式解析(3) Factory工厂模式 java设计模式解析( ...
- kafka的HA机制
1.kafka的HA机制:副本机制+消息同步+leader选举. 每个topic有多个partition,每个partition又有多个副本,这些副本当中也存在不同的角色,leader.followe ...
- 华东交通大学 2019 I 不要666 数位dp进阶
Problem Description 题库链接 666是一个网络用语,用来形容某人或某物很厉害很牛.而在西方,666指魔鬼,撒旦和灵魂,是不吉利的象征.所以邓志聪并不喜欢任何与6有关的数字.什么数字 ...
- neo4j 启动与关闭
neo4j开启与关闭 进入neo4j目录bin下. cd到bin目录下,执行启动命令: ./neo4j stop 另外neo4j还有其他命令,执行方式相同: neo4j { console | sta ...
- springboot 2.1.6发布
最新消息: Spring Boot 2.1.6 昨天正式发布了,日常更新一些依赖和修复一些 BUG,没什么硬菜! 重点来了,Spring Boot 1.5 将于今年 8 月结束使命,请尽快迁移到 Sp ...
- 洛谷P2456 二进制方程
题目 字符串模拟+并查集 建立两个并查集分别存放每个变量的每一位数的祖先,一个是1一个是2 考虑每个字母的每一位的数都是唯一的,先模拟,记录每一个变量的每一位. 一一映射到方程中去,最后将两个方程进行 ...
- 在Tex live和Beamer环境下编译中文
在Tex live和Beamer环境下编译中文时,容易出现缺少$的提示错误.它有可能是由于特殊字符所致,如下划线: 也有可能是插图有误所致.