Skip to content

Conversation

rdebay-scality
Copy link
Contributor

Security fix to prevent exposing repository structure on port 8080. Changed autoindex from on to off in nginx configuration.

Related: RD-680

@rdebay-scality rdebay-scality self-assigned this Sep 1, 2025
@rdebay-scality rdebay-scality requested a review from a team as a code owner September 1, 2025 12:22
@bert-e
Copy link
Contributor

bert-e commented Sep 1, 2025

Hello rdebay-scality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options
name description privileged authored
/after_pull_request Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval Bypass the pull request author's approval
/bypass_build_status Bypass the build and test status
/bypass_commit_size Bypass the check on the size of the changeset TBA
/bypass_incompatible_branch Bypass the check on the source branch prefix
/bypass_jira_check Bypass the Jira issue check
/bypass_peer_approval Bypass the pull request peers' approval
/bypass_leader_approval Bypass the pull request leaders' approval
/approve Instruct Bert-E that the author has approved the pull request. ✍️
/create_pull_requests Allow the creation of integration pull requests.
/create_integration_branches Allow the creation of integration branches.
/no_octopus Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity Change review acceptance criteria from one reviewer at least to all reviewers
/wait Instruct Bert-E not to run until further notice.
Available commands
name description privileged
/help Print Bert-E's manual in the pull request.
/status Print Bert-E's current status in the pull request TBA
/clear Remove all comments from Bert-E from the history TBA
/retry Re-start a fresh build TBA
/build Re-start a fresh build TBA
/force_reset Delete integration branches & pull requests, and restart merge process from the beginning.
/reset Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

@bert-e
Copy link
Contributor

bert-e commented Sep 1, 2025

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

@rdebay-scality rdebay-scality force-pushed the bugfix/MK8S-25-disable-http-directory-listing branch 2 times, most recently from 9f7f5e0 to 1825521 Compare September 4, 2025 21:01
@rdebay-scality rdebay-scality force-pushed the bugfix/MK8S-25-disable-http-directory-listing branch 2 times, most recently from 3bb0469 to 852d918 Compare September 23, 2025 11:00
Comment on lines 304 to 312
targets.extend(
[
# Repository-level saltenv structure
saltenv_dir / "index.html",
saltenv_dir / "redhat" / "index.html",
saltenv_dir / "redhat" / str(self._releasever) / "index.html",
# Top-level saltenv (for health check)
top_saltenv_dir / "index.html",
]
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This creation should be factorized.

@rdebay-scality rdebay-scality force-pushed the bugfix/MK8S-25-disable-http-directory-listing branch from 25dbb07 to 191132f Compare September 23, 2025 15:36
Security fix to prevent exposing repository structure on port 8080.

- Changed autoindex from on to off in nginx configuration.
- Use nginx location directives to return 200 for health checks instead of index files
  This maintains the original health check functionality while preventing
  directory structure exposure.

The nginx location = / and location = /saltenv/ directives handle health
check requests with 200 status, while location / handles all other requests
with autoindex off for security.

The nginx.conf.j2 template uses the archives variable to generate
location directives for each saltenv, but the variable wasn't being
passed in the template context. This caused Salt unit tests to fail.

The creation of index.html files was tried but it creates a chicken and
egg issue during the container startup when the files were not present.
Plus this approach is much more simple, no code, not so much salt, only
plain configuration.

Related: RD-680
@rdebay-scality rdebay-scality force-pushed the bugfix/MK8S-25-disable-http-directory-listing branch from 09e715b to 5ff8f6e Compare October 1, 2025 11:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants