Confirmed users
971
edits
Where's My Fox Security Review: Difference between revisions
Jump to navigation
Jump to search
→Direct File Access
No edit summary |
|||
| Line 31: | Line 31: | ||
To serve its static content, the app does a ioutil.ReadFile("." + req.URL.Path) ... I see there is a check for ".." above that but it still gives me the creeps. Is there no better way to do this? Also are we totally sure that filtering on ".." is enough? Maybe that code should only work in development mode while production mode uses a front-end proxy to service /static ? | To serve its static content, the app does a ioutil.ReadFile("." + req.URL.Path) ... I see there is a check for ".." above that but it still gives me the creeps. Is there no better way to do this? Also are we totally sure that filtering on ".." is enough? Maybe that code should only work in development mode while production mode uses a front-end proxy to service /static ? | ||
==== Process Execution ==== | |||
Nope. | |||
=== Templates === | === Templates === | ||