From 43ae54ba2a4583fbdbf8a7641bf584ab5f8153b1 Mon Sep 17 00:00:00 2001 From: Kevin Burke Date: Thu, 22 Jun 2017 19:33:42 -0700 Subject: [PATCH] net/http: document that Dir can serve sensitive directories Updates #20759. Change-Id: Ic61dcb6d101ad1491dca535aebb6ee8ee740d013 Reviewed-on: https://go-review.googlesource.com/46468 Reviewed-by: Brad Fitzpatrick --- src/net/http/fs.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/net/http/fs.go b/src/net/http/fs.go index 90a3729cbd..5819334b5f 100644 --- a/src/net/http/fs.go +++ b/src/net/http/fs.go @@ -30,6 +30,12 @@ import ( // value is a filename on the native file system, not a URL, so it is separated // by filepath.Separator, which isn't necessarily '/'. // +// Note that Dir will allow access to files and directories starting with a +// period, which could expose sensitive directories like a .git directory or +// sensitive files like .htpasswd. To exclude files with a leading period, +// remove the files/directories from the server or create a custom FileSystem +// implementation. +// // An empty Dir is treated as ".". type Dir string -- 2.48.1