location expression for a slash followed by a question mark

Question

I have an access log entry with a "/" immediately followed by a "?"

   "/?pp=env"
   "/?2bhT6ue7ZlYpD0rLyaMsKO4iPy4= <snip>"
   "/?2bhUqOt4gXp952HAfQ9G4ggBTNQ= <snip>"
   "/?rest_route=/wp/v2/users/"
   "/?search==%00{.cookie|UI19tE|value%3dCVE-2014-6287.}"
   "/?author=1"
   <many more of these> 

Note: there are many of these and it would be great if they can all be matched with one regex.

I have used this technique and it works great:

    location /index.php {
        if ($arg_title = Main_Page) {
            return 302 $scheme://$host/home;
        }
        <many more here>

But when I tried:

    location ~ ^/\?.* {
        rewrite ^ /unknown/ permanent;
    }

no luck.

Answer 1

This works.

location / {
        if ($args ~ ^.+$) {   # match an arg with any characters in it
           rewrite ^ /unknown/ permanent;
        }

        ...snip...
        proxy_pass http://localhost:8000;
}        

It still matches normal URLs and handles bad URLs as well:

   myhost/home    # pages in my site don't have args
   myhost/        # the ending slash navigates to home page 
   myhost         # also navigates to home page
   myhost/?crap=x # navigates to /unknown/