FileServer serves directories without trailing slash #12

Closed
SLaks opened this Issue Nov 20, 2012 · 2 comments

Comments

Projects
None yet
2 participants
@SLaks

SLaks commented Nov 20, 2012

If I have a FileServer with a default document in /folder/index.html, and I navigate to /folder, the FileServer will serve the contents of the default document.

This behavior is incorrect. The browser will resolve all relative paths as relative to the parent folder (/), since it thinks that folder is a filename.

The correct behavior is to serve a redirect to /folder/, which will then serve the default document as usual.

For security reasons, this should only happen if the folder has a default document; otherwise, attackers can discover arbitrary folder names within the document root.

@SLaks

This comment has been minimized.

Show comment
Hide comment
@SLaks

SLaks Nov 20, 2012

I'll fix this.

SLaks commented Nov 20, 2012

I'll fix this.

@sp

This comment has been minimized.

Show comment
Hide comment
@sp

sp Nov 20, 2012

Contributor

Awesome - that's been on my wishlist for a while.

Contributor

sp commented Nov 20, 2012

Awesome - that's been on my wishlist for a while.

@sp sp closed this in b592bb4 Nov 20, 2012

sp pushed a commit that referenced this issue Nov 20, 2012

sp
Merge pull request #13 from Unroll-Me/directory-redirect
Force directory URLs to end with / (fixes #12)
Drops v0.6 from Travis config to avoid failing build.

SLaks added a commit to SLaks/Styliner that referenced this issue Nov 29, 2012

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment