[GH-ISSUE #94] waf_rule_path in http context works improperly

kerem commented

2026-03-13 17:02:46 +03:00

Owner

Originally created by @ononoki1 on GitHub (May 9, 2022).
Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/94

Problem

The following config will not work:

http {
  waf_rule_path /path/to/rule/;
  server {
    waf on;
  }
}

While the following one works:

http {
  server {
    waf on;
    waf_rule_path /path/to/rule/;
  }
}

And this one also works:

http {
  waf on;
  waf_rule_path /path/to/rule/;
  server {
  }
}

Technically, NGINX's current context's config should inherit its parent's one, which is not the case in this particular circumstance. I think this should be a bug instead of a feature.

Originally created by @ononoki1 on GitHub (May 9, 2022). Original GitHub issue: https://github.com/ADD-SP/ngx_waf/issues/94 ## Problem The following config will not work: ```txt http { waf_rule_path /path/to/rule/; server { waf on; } } ``` While the following one works: ```txt http { server { waf on; waf_rule_path /path/to/rule/; } } ``` And this one also works: ```txt http { waf on; waf_rule_path /path/to/rule/; server { } } ``` Technically, NGINX's current context's config should inherit its parent's one, which is not the case in this particular circumstance. I think this should be a bug instead of a feature.

kerem

2026-03-13 17:02:46 +03:00

closed this issue
added the
needs-investigation
label

kerem commented

2026-03-13 17:03:02 +03:00

Author

Owner

@ononoki1 commented on GitHub (May 9, 2022):

The ngx_waf version is latest current branch.

@ononoki1 commented on GitHub (May 9, 2022): The ngx_waf version is latest current branch.

kerem commented

2026-03-13 17:03:07 +03:00

Author

Owner

@stale[bot] commented on GitHub (May 18, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
此 issue 因为最近没有任何活动已经被标记，如果在此之后的一段时间内仍没有任何活动则会被关闭。感谢您对项目的支持。

@stale[bot] commented on GitHub (May 18, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. 此 issue 因为最近没有任何活动已经被标记，如果在此之后的一段时间内仍没有任何活动则会被关闭。感谢您对项目的支持。

kerem commented

2026-03-13 17:03:12 +03:00

Author

Owner

@ononoki1 commented on GitHub (May 18, 2022):

What can I do to help investigate this issue?

@ononoki1 commented on GitHub (May 18, 2022): What can I do to help investigate this issue?

kerem commented

2026-03-13 17:03:17 +03:00

Author

Owner

@ADD-SP commented on GitHub (May 22, 2022):

There may be some bugs here, I'm not sure.

github.com/ADD-SP/ngx_waf@107cca9dec/src/ngx_http_waf_module_config.c (L1761-L1774)

github.com/ADD-SP/ngx_waf@107cca9dec/src/ngx_http_waf_module_config.c (L187-L203)

@ADD-SP commented on GitHub (May 22, 2022): There may be some bugs here, I'm not sure. https://github.com/ADD-SP/ngx_waf/blob/107cca9dec00edf97a9cd9f18cca465284e044bc/src/ngx_http_waf_module_config.c#L1761-L1774 https://github.com/ADD-SP/ngx_waf/blob/107cca9dec00edf97a9cd9f18cca465284e044bc/src/ngx_http_waf_module_config.c#L187-L203

kerem commented

2026-03-13 17:03:22 +03:00

Author

Owner

@stale[bot] commented on GitHub (May 29, 2022):

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
此 issue 因为最近没有任何活动已经被标记，如果在此之后的一段时间内仍没有任何活动则会被关闭。感谢您对项目的支持。

@stale[bot] commented on GitHub (May 29, 2022): This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. 此 issue 因为最近没有任何活动已经被标记，如果在此之后的一段时间内仍没有任何活动则会被关闭。感谢您对项目的支持。

kerem commented

2026-03-13 17:03:27 +03:00

Author

Owner

@ononoki1 commented on GitHub (May 29, 2022):

Since it's not a security bug and has a workaround, I just close it. You can reopen it when having time to solve.

@ononoki1 commented on GitHub (May 29, 2022): Since it's not a security bug and has a workaround, I just close it. You can reopen it when having time to solve.

Rows
Columns

[GH-ISSUE #94] waf_rule_path in http context works improperly #207

Problem