Scan for wp-toolkit injected/vulnerable rewrites in nginx conf

#!/bin/bash

# Ensure script is run as root
if [ "$EUID" -ne 0 ]; then
  echo "Error: Please run as root."
  exit 1
fi

RUN_DIR="$(pwd)"
RAW_DUMP="${RUN_DIR}/nginx_assembled_tree.txt"
MAIN_CONF="/etc/nginx/nginx.conf"

echo "========================================================================="
echo "Assembling Active Nginx Configuration Tree (No Compiler Check)..."
echo "Target Folder: ${RUN_DIR}"
echo "========================================================================="

if [ ! -f "$MAIN_CONF" ]; then
  echo "Error: Master file $MAIN_CONF not found."
  exit 1
fi

# Recursive function to mimic Nginx's include engine safely
resolve_includes() {
  local target_file="$1"
  if [ -f "$target_file" ]; then
    echo "## FILE_START: $target_file"

    while IFS= read -r line || [ -n "$line" ]; do
      # Clean trailing/leading spaces
      local clean_line=$(echo "$line" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')

      # If the line is an include directive, resolve its wildcards
      if [[ "$clean_line" =~ ^include[[:space:]] ]]; then
        # Strip 'include' and the trailing semicolon
        local include_path=$(echo "$clean_line" | awk '{print $2}' | tr -d ';')

        # Expand wildcards natively via bash array matching
        for expanded_file in $include_path; do
          if [ -f "$expanded_file" ]; then
            resolve_includes "$expanded_file"
          fi
        done
      else
        echo "$line"
      fi
    done < "$target_file"

    echo "## FILE_END: $target_file"
  fi
}

# Generate raw assembled configuration tree
resolve_includes "$MAIN_CONF" > "$RAW_DUMP"

echo "Structure mapping complete. Analyzing for CVE-2026-42945..."
echo "-------------------------------------------------------------------------"

VULN_COUNT=0
CURRENT_FILE="Master nginx.conf Scope"

# Context trackers
HAS_UNNAMED_REWRITE_WITH_QS=0
HAS_STACKED_DIRECTIVE=0
REWRITE_LINE=0
REWRITE_CONTENT=""
STACKED_LINE=0
STACKED_TYPE=""

LINE_NUM=0
while IFS= read -r RAW_LINE; do
  ((LINE_NUM++))

  CLEAN_LINE=$(echo "$RAW_LINE" | tr -d '\r' | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')

  # Catch file boundaries from our recursive function
  if [[ "$CLEAN_LINE" =~ ^##[[:space:]]FILE_START:[[:space:]] ]]; then
    CURRENT_FILE=$(echo "$CLEAN_LINE" | awk '{print $3}')
    continue
  fi

  # Skip whitespace and comments
  [[ "$CLEAN_LINE" =~ ^# ]] && continue
  [[ -z "$CLEAN_LINE" ]] && continue

  # Match unnamed rewrite rules containing a literal '?'
  if [[ "$CLEAN_LINE" =~ ^rewrite[[:space:]] ]] && [[ "$CLEAN_LINE" == *"?"* ]] && [[ "$CLEAN_LINE" != *"(?<"* ]]; then
    HAS_UNNAMED_REWRITE_WITH_QS=1
    REWRITE_LINE=$LINE_NUM
    REWRITE_CONTENT=$CLEAN_LINE
  fi

  # Match stacked target blocks inside the same context scope
  if [[ "$CLEAN_LINE" =~ ^(set|if|rewrite)[[:space:]] ]]; then
    if [ "$LINE_NUM" -ne "$REWRITE_LINE" ]; then
      HAS_STACKED_DIRECTIVE=1
      STACKED_LINE=$LINE_NUM
      STACKED_TYPE=$(echo "$CLEAN_LINE" | awk '{print $1}')
    fi
  fi

  # Scope evaluation and state reset
  if [[ "$CLEAN_LINE" == *"}"* ]]; then
     if [ $HAS_UNNAMED_REWRITE_WITH_QS -eq 1 ] && [ $HAS_STACKED_DIRECTIVE -eq 1 ]; then
        ((VULN_COUNT++))
        echo "[!] STRUCTURAL THREAT DETECTED IN CONFIG TREE"
        echo "    File Reference: $CURRENT_FILE"
        echo "    Vulnerable Line: $REWRITE_CONTENT"
        echo "    Trigger Neighbor: Stacked ($STACKED_TYPE) on line $STACKED_LINE of stream"
        echo "-------------------------------------------------------------------------"
     fi
     HAS_UNNAMED_REWRITE_WITH_QS=0
     HAS_STACKED_DIRECTIVE=0
  fi

done < "$RAW_DUMP"

echo "========================================================================="
echo "Analysis completed."
echo "Total vulnerable blocks identified: $VULN_COUNT"
echo "========================================================================="

# Clean up raw stream map file
rm -f "$RAW_DUMP"