# SPDX-License-Identifier: AGPL-3.0-only
# An attempt to walk out of the document root with a literal `../`.
# There is no legitimate request containing one: a browser resolves the
# path before sending it.
parser: http-traversal
log: http
prefilter: "../"
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "]*\.\./[^ "]*) [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx
