如何修复Nginx Amplify检测到的「Regex location has no regex pattern」错误

我正在运行Nginx并搭配Nginx Amplify使用，在Amplify的Analyzer > Static Analysis模块中，我遇到了以下错误：

Regex location has no regex pattern
Regex location has a valid modifier, but does not have a regex pattern.

Amplify给出的性能建议：

Performance-wise it is more efficient to configure exact or prefix matching for locations that do not require regex matching. It is also less prone to errors. Please refer to the documentation describing location directive to learn more.

检测到问题的文件及对应行号：

• /etc/nginx/conf.d/mail.example.com.conf，第27行
• /etc/nginx/conf.d/mail.example.com.conf，第89行
• /etc/nginx/sites-enabled/03-example2.com.conf，第176行
• /etc/nginx/sites-enabled/03-example2.com.conf，第265行

第一个配置文件：mail.example.com.conf #

我的虚拟主机配置如下：

server {

# Restrict access to LAN & Other IP's

allow 192.168.x.x/24; # AC3200 LAN IP Address

allow x.x.x.x/32; # Work IP address

allow x.x.x.x/32; # Apt. IP Address

deny all;

#error_page 403 =444;

# Begin Server Directives

server_name mail.example.com;

root /var/www/roundcube/;

index index.php index.html index.htm;

# Logs

error_log /var/log/nginx/mail.example.com.error.log;

access_log /var/log/nginx/mail.example.com.access.log;

location / {

try_files $uri $uri/ /index.php;

}

location ~ \.php$ {

# Pass FastCGI to PHP7.4 with included settings in the snippet

include snippets/fastcgi-php.conf;

}

location ~ /.well-known/acme-challenge {

allow all;

}

location ~ ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {

deny all;

}

location ~ ^/(bin|SQL)/ {

deny all;

}

# A long browser cache lifetime can speed up repeat visits to your page

location ~ \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {

access_log off;

log_not_found off;

expires 360d;

}

listen *:443 ssl;

http2 on;

ssl_certificate /etc/letsencrypt/live/mail.example.com/fullchain.pem; # managed by Certbot

ssl_certificate_key /etc/letsencrypt/live/mail.example.com/privkey.pem; # managed by Certbot

include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

ssl_dhparam /etc/ssl/private/dhparams4096.pem; # Managed by admin

add_header Strict-Transport-Security "max-age=31536000" always; # managed by Certbot

ssl_trusted_certificate /etc/letsencrypt/live/mail.example.com/chain.pem; # managed by Certbot

ssl_stapling on; # managed by Certbot

ssl_stapling_verify on; # managed by Certbot

}

server {

if ($host = mail.example.com) {

return 301 https://$host$request_uri;

}

# managed by Certbot

# Restrict access to LAN & Moms IP & Apartment IP's

allow x.x.x.x/24; # LAN IP Address

allow x.x.x.x/32; # Work IP address

allow x.x.x.x/32; # Apt. IP Address

deny all;

#error_page 403 =444;

# Begin Server Directives

listen *:80;

server_name mail.example.com;

root /var/www/roundcube/;

index index.php index.html index.htm;

error_log /var/log/nginx/mail.example.com.error.log;

access_log /var/log/nginx/mail.example.com.error.log;

location / {

try_files $uri $uri/ /index.php;

}

location ~ \.php$ {

#try_files $uri =404;

# Pass FastCGI to PHP7.4 with included settings in the snippet

include snippets/fastcgi-php.conf;

}

location ~ /.well-known/acme-challenge {

allow all;

}

location = ^/(README|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {

deny all;

}

location ~ ^/(bin|SQL)/ {

deny all;

}

# LINUXBABE + Extra Extensions

# A long browser cache lifetime can speed up repeat visits to your page

location ~ \.(txt|flv|pdf|avi|mov|ppt|wmv|mp3|ogg|webm|aac|jpg|ogg|ogv|svgz|eot|otf|mp4|rss|atom|zip|tgz|gz|rar|bz2|doc|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf|jpeg|gif|png|swf|jpeg|webp|svg|woff|woff2|ttf|css|js|ico|xml|otf|woff|woff2)$ {

access_log off;

log_not_found off;

expires 1y;

}

}

Amplify指出的问题行是：

location ~ /.well-known/acme-challenge {

第二个配置文件：03-example2.com.conf #

我的配置如下：

server {

listen 80;

server_name example2.com www.example2.com;

return 301 https://$host$request_uri;

}

server {

listen *:443 ssl;

http2 on;

server_name example2.com www.example2.com;

root /var/www/example2.com/;

##

# SECURITY HEADERS

##

# Strict Transport Security Response Header

# Use "always" Paramater to help prevent MITM attacks.

# ADMIN Note: Including the Preload Paramerter will cause web browsers to cache this header

# permanently in their browser code for about two months. Use only if you want to permanently

# commit this header to your site. If you change it, it will take a long time for changes to

# be reflected in the web browsers.

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# Content Security Policy (CSP)

#add_header Content-Security-Policy "frame-ancestors 'self';";

# https://gabriel.nu/tutorials/Ubuntu-20.04-NGINX-LEMP-secure-web-server-for-WordPress-DIY.html

add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;

#add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'";

# https://walterebert.com/blog/using-csp-wordpress/

#add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: http: https: *.gravatar.com; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' http: https: fonts.googleapis.com; font-src 'self' data: http: https: fonts.googleapis.com themes.googleusercontent.com;" always;

# https://nowherelan.com/2018/12/27/secure-your-wordpress-site-with-the-content-security-policy-csp-http-header-in-apache/

#add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: http: https: *.gravatar.com *.wp.com *.wordpress.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: *.wp.com *.wordpress.com; style-src 'self' 'unsafe-inline' http: https: fonts.googleapis.com *.wp.com *.wordpress.com; font-src 'self' data: http: https: fonts.googleapis.com themes.googleusercontent.com *.wp.com *.wordpress.com; frame-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: *.wp.com *.wordpress.com"

# Secure MIME Types with X-Content-Type-Options. Below line adds the X-Frame-Options header in Nginx.

add_header X-Content-Type-Options "nosniff" always;

# Referrer Policy

#add_header Referrer-Policy "strict-origin";

# https://gabriel.nu/tutorials/Ubuntu-20.04-NGINX-LEMP-secure-web-server-for-WordPress-DIY.html

add_header Referrer-Policy "no-referrer-when-downgrade" always;

# Permissions Policy

add_header Permissions-Policy "geolocation=(), autoplay=(), encrypted-media=(), midi=(), usb=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=(self)";

# X-FastCGI-Cache

# This line adds the X-FastCGI-Cache header in the HTTP response. It can be used to validate whether

# the request has been served from the FastCGI cache or not.

# ADMIN Note: Linuxbabe originally had this directive in "location ~ \.php$ {", however, we don't use it

# there because it invalidates any other currently used headers and only implements itself.

add_header X-FastCGI-Cache $upstream_cache_status always;

# Clear Site Data

# When we use a webpage, we can leave various pieces of data in the browser that we’d like to clear

# out if the user logs out or deletes their account. Clear Site Data gives us a reliable way to do

# that.

# ADMIN Note: We decided to enable it globally on all pages via:

add_header Clear-Site-Data "*";

# X-Frame Options

# Prevent click jacking by adding an X-Frame-Options header

add_header x-frame-options "SAMEORIGIN" always;

# X-SSS Protections

# Enable X-XSS-Protection header in Nginx

add_header X-XSS-Protection "1; mode=block" always;

# LINUXBABE

# If you allow people to upload files, or are concerned about intruders using a different flaw to get

# files onto your server AND the content on your domain should not be accessed via other websites

# possibly trying to impersonate you, then yes X-Permitted-Cross-Domain-Policies "none" will provide a

# security benefit. The attack is less relevant these days, as any user of modern software first

# needs to be tricked into allowing Flash or active PDF content.

# If your website is just a regular website with nothing that requires a login to access, then you don't need it.

# https://www.linuxbabe.com/ubuntu/install-wordpress-ubuntu-20-04-nginx-mariadb-php7-4-lemp

# https://security.stackexchange.com/questions/166024/does-the-x-permitted-cross-domain-policies-header-have-any-benefit-for-my-websit

add_header X-Permitted-Cross-Domain-Policies none;

# LINUXBABE (User recommendation)

# Ignore Cache Control

# Keep fastcgi working if it's not getting hits

# ADMIN Note: Only use this if fastcgi cache status is not getting hits

#fastcgi_ignore_headers Cache-Control Expires Set-Cookie;

##

# SSL

##

# Certificate Path (signed)

ssl_certificate /etc/letsencrypt/live/example2.com/fullchain.pem; # Managed by ADMIN

# Certificate Path (intermediate)

ssl_certificate_key /etc/letsencrypt/live/example2.com/privkey.pem; # Managed by ADMIN

# Certificate Path (Chain of trust of OCSP response using Root CA and intermediate certificates)

ssl_trusted_certificate /etc/letsencrypt/live/example2.com/chain.pem; # Managed by ADMIN

# Perfect Forward Secrecy (Diffie Hellman 4096) Path

ssl_dhparam /etc/ssl/private/dhparams4096.pem; # Managed by ADMIN

# Mozilla Modern Compatibilty

# Strict Settings with OCSP stapling turned on for A+ Rating at ssllabs.com

ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLERequires nginx >= 1.13.0 else use TLSv1.2 # Dropping TLSv1.1 for modern compatability.

ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';

ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0

ssl_prefer_server_ciphers on;

ssl_session_timeout 1d;

ssl_session_cache shared:MozSSL:10m; # About 40000 sessions

ssl_session_tickets off;

# OCSP stapling

ssl_stapling on;

ssl_stapling_verify on;

resolver 1.1.1.1 1.0.0.1;

##

# LOGS

##

# ADMIN Note: Adding "if=$log_ip" to the end of access log lines will exclude your own ip address from access logs to prevent skewing data

# Access Log (Netdata)

access_log /var/log/nginx/example2.com.access.log netdata if=$log_ip;

# Access Log (Amplify)

access_log /var/log/nginx/example2.com.access.log apm if=$log_ip;

# Error Log

error_log /var/log/nginx/example2.com.error.log warn;

##

# PAGESPEED

##

# ADMIN Note: Pagespeed is broken on Nginx v1.25.1 and up, so we should comment all of it out here and in the "nginx.conf" file

# Settings per this virtual host

# Enable Pagespeed module

#pagespeed on;

#pagespeed Domain http*://*.example2.com;

# Settings per all virtual hosts

#include /etc/nginx/pagespeed.conf;

##

# LOCATION DIRECTIVES 1

##

index index.php index.html index.htm index.nginx-debian.html;

# ADMIN

# https://serverfault.com/questions/1137324/difference-between-3-similar-nginx-location-directives-provided-in-three-separat/1137342#1137342

location / {

try_files $uri $uri/ /index.php$is_args$args;

}

### BEGIN: "Converter for Media" Wordpress Plugin

set $ext_avif ".avif";

if ($http_accept !~* "image/avif") {

set $ext_avif "";

}

set $ext_webp ".webp";

if ($http_accept !~* "image/webp") {

set $ext_webp "";

}

location ~ /wp-content/(?<path>.+)\.(?<ext>jpe?g|png|gif|webp)$ {

add_header Vary Accept;

expires 365d;

try_files

/wp-content/uploads-webpc/$path.$ext$ext_avif

/wp-content/uploads-webpc/$path.$ext$ext_webp

$uri =404;

}

### END: "Converter for Media" Wordpress Plugin

# ADMIN

# https://serverfault.com/questions/755662/nginx-disable-htaccess-and-hidden-files-but-allow-well-known-directory

# location ~ /.well-known {

location ~ /\.well-known {

allow all;

}

# ADMIN

location = /favicon.ico {

log_not_found off;

access_log off;

}

# ADMIN

location = /robots.txt {

allow all;

log_not_found off;

access_log off;

}

# LINUXBABE

location ~ ^/wp-json/ {

rewrite ^/wp-json/(.*?)$ /?rest_route=/$1 last;

}

# LINUXBABE

location ~ /wp-sitemap.*\.xml {

try_files $uri $uri/ /index.php$is_args$args;

}

# LINUXBABE

error_page 404 /404.html;

error_page 500 502 503 504 /50x.html;

# LINUXBABE

location = /50x.html {

root /var/www/html;

}

# ADMIN

# DISALLOW ACCESS of /xmlrpc.php

# EXCEPT FROM internal IP's and Home & Apartment IP's.

#location ^~ /xmlrpc.php$ {

#allow xxx.xxx.xx.x/24; # AC3200 LAN IP Address

#allow xxx.xx.xxx.xxx/32; # Home IP address

#allow xxx.xx.xxx.xxx/32; # Apt. IP Address

#deny all;