Skip to content

FileServer serves directories without trailing slash #12

Closed
SLaks opened this Issue Nov 20, 2012 · 2 comments

2 participants

@SLaks
SLaks commented Nov 20, 2012

If I have a FileServer with a default document in /folder/index.html, and I navigate to /folder, the FileServer will serve the contents of the default document.

This behavior is incorrect. The browser will resolve all relative paths as relative to the parent folder (/), since it thinks that folder is a filename.

The correct behavior is to serve a redirect to /folder/, which will then serve the default document as usual.

For security reasons, this should only happen if the folder has a default document; otherwise, attackers can discover arbitrary folder names within the document root.

@SLaks
SLaks commented Nov 20, 2012

I'll fix this.

@sp
sp commented Nov 20, 2012

Awesome - that's been on my wishlist for a while.

@sp sp closed this in b592bb4 Nov 20, 2012
@SLaks SLaks added a commit to SLaks/Styliner that referenced this issue Nov 29, 2012
@SLaks SLaks Remove trailing / handler after fixing capsela/capsela#12 886fab7
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Something went wrong with that request. Please try again.