Package: gixy-ng
GIXYOverviewGixy is a tool to analyze Nginx configuration.
The main goal of Gixy is to prevent security misconfiguration and automate flaw detection.Currently supported Python versions are 3.6, 3.7, 3.8 and 3.9.Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues.What it can doRight now Gixy can find:[ssrf] Server Side Request Forgery[http_splitting] HTTP Splitting[origins] Problems with referrer/origin validation[add_header_redefinition] Redefining of response headers by  "add_header" directive[host_spoofing] Request's Host header forgery[valid_referers] none in valid_referers[add_header_multiline] Multiline response headers[alias_traversal] Path traversal via misconfigured alias[if_is_evil] If is evil when used in location context[allow_without_deny] Allow specified without deny[add_header_content_type] Setting Content-Type via add_header[resolver_external] Using external DNS nameservers[version_disclosure] Using insecure values for server_tokensYou can find things that Gixy is learning to detect atIssues labeled with "new plugin"InstallationCentOS/RHEL and other RPM-based systemsyum-yinstallhttps://extras.getpagespeed.com/release-latest.rpm
yum-yinstallgixyOther systemsGixy is distributed onPyPI. The best way to install it is with pip:pipinstallgixy-ngRun Gixy and check results:gixyUsageBy default, Gixy will try to analyze Nginx configuration placed in/etc/nginx/nginx.conf.But you can always specify needed path:$ gixy /etc/nginx/nginx.conf

==================== Results ===================

Problem: [http_splitting] Possible HTTP-Splitting vulnerability.
Description: Using variables that can contain "\n" may lead to http injection.
Additional info: https://github.com/dvershinin/gixy/blob/master/docs/ru/plugins/httpsplitting.md
Reason: At least variable "$action" can contain "\n"
Pseudo config:
include /etc/nginx/sites/default.conf;

	server {

		location ~ /v1/((?<action>[^.]*)\.json)?$ {
			add_header X-Action $action;
		}
	}


==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 1Or skip some tests:$ gixy --skips http_splitting /etc/nginx/nginx.conf

==================== Results ===================
No issues found.

==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 0Or something else, you can find all othergixyarguments with the help command:gixy --helpYou can also makegixyuse pipes (stdin), like so:echo"resolver 1.1.1.1;"|gixy-Docker usageGixy is available as a Docker imagefrom the Docker hub. To
use it, mount the configuration that you want to analyse as a volume and provide the path to the
configuration file when running the Gixy image.$ docker run --rm -v `pwd`/nginx.conf:/etc/nginx/conf/nginx.conf getpagespeed/gixy /etc/nginx/conf/nginx.confIf you have an image that already contains your nginx configuration, you can share the configuration
with the Gixy container as a volume.$  docker run --rm --name nginx -d -v /etc/nginx
nginx:alpinef68f2833e986ae69c0a5375f9980dc7a70684a6c233a9535c2a837189f14e905

$  docker run --rm --volumes-from nginx dvershinin/gixy /etc/nginx/nginx.conf

==================== Results ===================
No issues found.

==================== Summary ===================
Total issues:
    Unspecified: 0
    Low: 0
    Medium: 0
    High: 0ContributingContributions to Gixy are always welcome! You can help us in different ways:Open an issue with suggestions for improvements and errors you're facing;Fork this repository and submit a pull request;Improve the documentation.Code guidelines:Python code style should followpep8standards whenever possible;Pull requests with new plugins must have unit tests for it.