net/http, security: http.FileServer may inadvertently expose sensitive directories

[kevinburke]

The default http.FileServer(http.Dir(".")) implementation exposes all files and folders in the working directory. This includes directories like .git or .svn, which an attacker can use to recover the source code comprising the server, if for example people deploy by running a "git clone" and a "go install." This is how Heroku handles Go deployments and I am sure others do as well; it's common if you run Macs locally but deploy on Linux.

This is not a hypothetical attack, one estimate found 9700 of the Alexa top 1 million sites expose the .git directory: https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/

I am wondering whether the Go standard library should do anything to help prevent these inadvertent directory exposures. Our hands are slightly tied by the current API, which exposes everything and can't change.

Some options:

• Do nothing

• Document the potential vulnerability and leave it at that.

• Add http.SafeDir or similar, that 404's on any file beginning with a .. This should cover most private files, including .htpasswd.

• Add SafeDir to httputil.

• Modify http.Dir to exclude files that begin with a .. This would break backwards compatibility, and seems like a bad idea.

[bradfitz]

Documenting seems fine.

[kevinburke]

Turns out Heroku deletes that dir but you can see a few others on this sample app, including the raw binary for the server https://go-simple-http-server.herokuapp.com/

[gopherbot]

CL https://golang.org/cl/46468 mentions this issue.

[crazcalm]

I recently wrote a blog post on how to create a file server that both hides and denies access to dot files (post).

I am willing to write this documentation (and an example_test.go for the net/http package). Can someone point me in the right direction as to where the documentation for this issue should be written? Also, I would like to know how the example_test.go files work and if there are any standards when writing one.

Any help would be gladly appreciated! Thanks!

[bradfitz]

See https://blog.golang.org/examples

[crazcalm]

@bradfitz Thanks!