Papa Dragon (back on Streams)

Thu, 14 May 2026 23:16:11 +0200 dernière modification : Fri, 15 May 2026 15:33:14 +0200 de CaseLibre

Hi folks!

Long time no see…

I’m posting here because I still am the *cough* maintainer of the Forte YunoHost package. And I’ve just received a review request for this ~~Dirty Frag~~ Nginx Rift related PR. Thing is I’m not technically skilled so this goes way beyond my knowledge.

If a Nginx conf mogul reads this I’d be glad to have her/his opinion on the proposed changes. I tried an install with this conf, it runs well and the federation is working, so it seems quite safe. But a more informed opinion would be great (@Mike Macgirvin you never said that you were a Nginx expert but you sure now a lot more about it than me).

EDIT: Has nothing to do with Dirty Frag, actually

#Forte #YunoHost #Nginx

montre tout 4 commentaires

Fri, 15 May 2026 00:15:14 +0200 dernière modification : Fri, 15 May 2026 00:15:45 +0200 de CaseLibre

OK, this seems relevant if you read this (temporary mitigation section): NGINX Rift (CVE-2026-42945): Patched nginx available in testing.

Papa Dragon (back on Streams)

Fri, 15 May 2026 09:51:57 +0200 de CaseLibre

Well after sleeping on it, it seems that there's nothing to fix here:

When a rewrite directive uses an unnamed PCRE capture ($1, $2, and so on) with a replacement that contains a question mark, and is followed by another rewrite, if, or set directive, nginx computes the destination buffer size using one escaping method but writes the result using a different one.

Since there’s only one rewrite per scope, the PR changes seem to be unnecessary.

Papa Dragon (back on Streams)

Fri, 15 May 2026 15:32:45 +0200 de CaseLibre

Plot twist! The changes may actually be relevant, as there are two rewrites in the Nginx configuration.

a rewrite directive with an unnamed regex capture ($1, $2) and a replacement string that contains a question mark, followed by another rewrite, if, or set directive.

But does not mention whether it must be "followed immediately by" or not. Without further clarification, my understanding is that it may not.

So to play it safe, both PRs will be merged.

#Forte #Streams