qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-18 02:54:47 -07:00
Code Releases Activity

net/http: document that Dir can serve sensitive directories

Browse Source 
Updates #20759.

Change-Id: Ic61dcb6d101ad1491dca535aebb6ee8ee740d013
Reviewed-on: https://go-review.googlesource.com/46468
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Kevin Burke 2017-06-22 19:33:42 -07:00 committed by Brad Fitzpatrick
parent 143bdc2793
commit 43ae54ba2a
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/net/http/fs.go
View File

@ -30,6 +30,12 @@ import (
// value is a filename on the native file system, not a URL, so it is separated
// by filepath.Separator, which isn't necessarily '/'.
//
// Note that Dir will allow access to files and directories starting with a
// period, which could expose sensitive directories like a .git directory or
// sensitive files like .htpasswd. To exclude files with a leading period,
// remove the files/directories from the server or create a custom FileSystem
// implementation.
//
// An empty Dir is treated as ".".
type Dir string