Sensitive information disclosure about simple-http-server HOT 13 CLOSED

I think simple-http-server is breaking user expectations by serving files above the current working directory.

For python's http.server, http://localhost:8000/..%2f will map to $(cwd)/.
Whereas for simple-http-server, http://localhost:8000/..%2f will map to $(cwd)/../.

A user who is not aware of this will be accidentally exposing their system to the network, particularly when they have the --upload flag enabled.

from simple-http-server.

Serving files above the path the server was invoked in/with is a major security issue. @TheWaWaR This issue should be reopened. I will fix it today. Additionally after It's fixed all previous versions should be marked with a security notice.

from simple-http-server.

The behavior of using other web-servers is different from it

from simple-http-server.

Proposes to prevent access to non-web directories

from simple-http-server.

I think you shouldn't run simple-http-server in /etc

from simple-http-server.

I think it doesn't matter where it runs, it's a security hole.

from simple-http-server.

The permission of /etc/passwd is -rw-r--r-- means whatever a normal user can read the file, why simple-http-server run by current user can't read the file?

from simple-http-server.

But nginx can do that, https://serverfault.com/questions/588770/why-can-nginx-access-etc-pass

from simple-http-server.

I also expected simple-http-server to only serve the current working directory. Is that really not the case?

from simple-http-server.

Sorry, it's definitely a serious problem.

from simple-http-server.

Fixed in #35

from simple-http-server.

I could use a windows tester for #35 (comment)

from simple-http-server.

Thanks :D

from simple-http-server.