Problem/Motivation
Drupal's .htaccess and web.config files provide reasonable protection for sensitive files from prying eyes. There is FilesMatch (Apache) and a rewrite rule (IIS) that block accessing certain files based on a file name match. Looking at the history of the file over time, we only kept adding new patterns but never cleaned them up.
They provide protection for:
- Accessing PHP files directly via the web server (module, install, inc, profile, etc).
- Accessing sensitive static files (twig, yml, po, composer.json, composer.lock, etc).
- Access said files as temporary edit files of Vim and emacs (swo, swp, ~, etc).
- Patch residue (.bak, .orig, #foo.php#, etc).
Among these rules, there are some out dated rules such as code-style.pl that are no longer relevant (code-style.pl was removed many years ago).
The regular expression is getting difficult to read and there are some improvements that we can (micro) optimize.
Proposed resolution
Evaluate the current list of rewrite rules. Remove the ones that we no longer need, and combine/optimize them.
Remaining tasks
* Discuss on the components to remove as they are no longer necessary.
* Optimize the rewrite rules to adapt to modern directory structures (.well-known directory is excluded from ^\..* matching for example)
* Optimize the regular expression with non capturing group.
* Discuss to change the order of rewrite rules to make them easier to read (file extensions, followed by exact file names, followed by dot files, followed by edit/patch residue, etc).
* Remove file patterns that we block, but are no longer relevant. For example, SVN-related file matches are not necessary because a parent level dot-directory match will block them. Other than that, Entries.*|Repository|Root|Tag|Template|all-wcprops|entries|format seems to have survived from early as 2003, but I couldn't find concrete evidence why they should be blocked, considering we block the .svn directory they are contained in.
* Update .htaccess and web.config configuration.
* Update nginx and other web server documentation as necessary.
User interface changes
None.
API changes
None.
The release notes will need to say that we updated the .htaccess file, and the tests need to be updated of course. No other API changes.
Data model changes
None.