From: Kevin Burke <kev@inburke.com>
Date: Fri, 23 Jun 2017 02:33:42 +0000 (-0700)
Subject: net/http: document that Dir can serve sensitive directories
X-Git-Tag: go1.9beta2~15
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=43ae54ba2a4583fbdbf8a7641bf584ab5f8153b1;p=gostls13.git

net/http: document that Dir can serve sensitive directories

Updates #20759.

Change-Id: Ic61dcb6d101ad1491dca535aebb6ee8ee740d013
Reviewed-on: https://go-review.googlesource.com/46468
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
---

diff --git a/src/net/http/fs.go b/src/net/http/fs.go
index 90a3729cbd..5819334b5f 100644
--- a/src/net/http/fs.go
+++ b/src/net/http/fs.go
@@ -30,6 +30,12 @@ import (
 // value is a filename on the native file system, not a URL, so it is separated
 // by filepath.Separator, which isn't necessarily '/'.
 //
+// Note that Dir will allow access to files and directories starting with a
+// period, which could expose sensitive directories like a .git directory or
+// sensitive files like .htpasswd. To exclude files with a leading period,
+// remove the files/directories from the server or create a custom FileSystem
+// implementation.
+//
 // An empty Dir is treated as ".".
 type Dir string