Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Accessible git directory #495

Closed
Stopka opened this issue Jan 19, 2024 · 2 comments · Fixed by #496
Closed

[BUG] Accessible git directory #495

Stopka opened this issue Jan 19, 2024 · 2 comments · Fixed by #496
Labels

Comments

@Stopka
Copy link

Stopka commented Jan 19, 2024

Bug
The docker image contains and exposes the .git directory. It's generally considered a security flaw to expose it or even have it in the container image.
There is also accessible a .editorconfig

How to replicate

  1. Run the image using the official manual https://ttrss.henry.wang/#deployment-via-docker
  2. Try to request any file from git folder like http://localhost:80/.git/config

Expected behavior
Response with 404 http status

Actual behavior
Browser downloads file from .git directory.

Proposed fix
Add .git direcotry and .editorconfig file to .dockerignore file to be omitted from the container image build.

Affected version
Tested on current wangqiru/ttrss:latest (containing Tiny Tiny RSS v23.12-d4ae6c6)

@Stopka
Copy link
Author

Stopka commented Mar 6, 2024

Thank you 🙏

@Joselo2022
Copy link

Kk

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants