# SPDX-License-Identifier: AGPL-3.0-only
# The same walk, percent-encoded once or twice (%2e%2e%2f, %252e...),
# or a request naming a system file outright (/etc/passwd, win.ini,
# php:// and file:// wrappers).
#
# Two parsers rather than one because the prefilter is a literal and
# `%2e` and `%2E` are different literals; this one takes the lower-case
# form, which is what tooling emits. The upper-case form is caught by
# the sibling parser.
parser: http-traversal-encoded
log: http
prefilter: "%2e"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "]*%(?:25)?2e%(?:25)?2e[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx
