0xJacky 389e395469 fix(nginx): harden namespace config sandbox isolation ...

The per-namespace sandbox reimplemented nginx's config grammar with line
scanning and substring matching, which produced both false PASS and false
FAIL verdicts, and could write through a recreated directory symlink into
the live configuration tree.

- Refuse to write through symlinked path components when mirroring
  dependencies, so a conf.d -> http.d style link can no longer overwrite
  the real configuration and leave it pointing at a deleted temp dir.
- Tokenize the configuration instead of scanning lines: quoted strings,
  trailing comments and multi-line blocks no longer corrupt brace depth,
  and namespace includes are injected against a brace stack. Fail the
  test when the includes could not be injected at all.
- Treat a zero-match wildcard include as valid, matching nginx's
  ngx_conf_include; only a literal missing include is fatal.
- Skip the sandbox when nginx runs in a separate container, where the
  generated path is not visible to nginx -t.
- Classify sites-enabled and streams-enabled by resolved path so indirect
  includes cannot pull in other namespaces' sites.
- Quote generated include paths, resolve each include occurrence
  independently, and prefer the conf prefix for relative includes.
- Surface site and stream query failures instead of validating an empty
  sandbox, and report the validated counts.
- Preserve stderr from successful docker exec runs, serialize the nginx
  path caches, and add SandboxReason so the UI can explain a skip.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-07-28 11:23:28 +08:00

..

control_test.go

fix(nginx): harden namespace config sandbox isolation

2026-07-28 11:23:28 +08:00

control.go

fix(nginx): harden namespace config sandbox isolation

2026-07-28 11:23:28 +08:00

directives.go

…

modules.go

…

nginx.go

…

performance.go

…

router.go

…

status.go

…

websocket.go

…