The process_extending_files in httpd-run script uses a directory that is in the www root

Open
#255 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
45/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
apache, docker, shell
Domain
devops, security

Research direction

Start with 2.4/root/usr/bin/run-httpd, especially line 16 and the process_extending_files path. Check how the httpd-pre-init directory is used and verify that extending files are still processed while the directory is no longer exposed through the web root. Confirm the behavior with a container-level access check.

Written by the indexing model from the issue text.

Description

Description

In https://github.com/sclorg/httpd-container/blob/4d238482685f3926826d317e0cf18a425f504487/2.4/root/usr/bin/run-httpd line 16 processes extending files, in this path ${HTTPD_APP_ROOT}/src/httpd-pre-init/ but this path is on the path of the www root, which makes the files inside this directory readable through the http/https from outside. Should this not be in ${HTTPD_APP_ROOT}/httpd-pre-init/ so that its content is not available to external clients?

Dominant language
Shell
Stars
52
Forks
122
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from sclorg/httpd-container

All issues in sclorg/httpd-container

Similar issues

More Shell/Bash issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.