qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-23 10:20:03 -07:00
Code Releases Activity

net/http: make triv.go example less insecure

Browse Source 
The triv.go example serves the entire contents of $HOME by default.
That seems bad, let's not do that.

Also change it to listen on localhost only.

Change-Id: I8f1b7bd6b7d737852273e2ba82deabc4a2d11f6b
Reviewed-on: https://go-review.googlesource.com/c/go/+/428237
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
This commit is contained in:
Damien Neil 2022-09-03 19:51:48 -07:00
parent e1e88d636b
commit dc629ec939
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/net/http/triv.go
View File

@ -118,7 +118,7 @@ func Logger(w http.ResponseWriter, req *http.Request) {
http.Error(w, "oops", http.StatusNotFound)
}
var webroot = flag.String("root", os.Getenv("HOME"), "web root directory")
var webroot = flag.String("root", "", "web root directory")
func main() {
flag.Parse()
@ -128,11 +128,13 @@ func main() {
expvar.Publish("counter", ctr)
http.Handle("/counter", ctr)
http.Handle("/", http.HandlerFunc(Logger))
http.Handle("/go/", http.StripPrefix("/go/", http.FileServer(http.Dir(*webroot))))
if *webroot != "" {
http.Handle("/go/", http.StripPrefix("/go/", http.FileServer(http.Dir(*webroot))))
}
http.Handle("/chan", ChanCreate())
http.HandleFunc("/flags", FlagServer)
http.HandleFunc("/args", ArgServer)
http.HandleFunc("/go/hello", HelloServer)
http.HandleFunc("/date", DateServer)
log.Fatal(http.ListenAndServe(":12345", nil))
log.Fatal(http.ListenAndServe("localhost:12345", nil))
}