fileserver: hide the data directory when it is relative (#8327)

Kévin Dunglas committed Nov 1, 2026 at 21:57 UTC 9dd12fdb5d975d23a581897149d14d7186747634

2 files changed +27

modules/caddyhttp/fileserver/staticfiles.go

@@ -210,6 +210,13 @@ func (fsrv *FileServer) Provision(ctx caddy.Context) error {

210 fsrv.IndexNames = defaultIndexNames

211 }

212

213 + // a relative data directory sits under the working directory and holds private keys

214 + if dataDir := caddy.AppDataDir(); !filepath.IsAbs(dataDir) {

215 + if abs, err := caddy.FastAbs(dataDir); err == nil {

216 + fsrv.Hide = append(fsrv.Hide, abs)

217 + }

218 + }

219 +

220 // for hide paths that are static (i.e. no placeholders), we can transform them into

221 // absolute paths before the server starts for very slight performance improvement

222 for i, h := range fsrv.Hide {

modules/caddyhttp/fileserver/staticfiles_hide_test.go

+20

@@ -122,3 +122,23 @@ func TestBrowseHidesPathQualifiedEntries(t *testing.T) {

122 })

123 }

124 }

125 +

126 +func TestHideRelativeDataDir(t *testing.T) {

127 + for _, env := range []string{"XDG_DATA_HOME", "HOME", "AppData", "HOMEDRIVE", "HOMEPATH", "USERPROFILE", "home"} {

128 + t.Setenv(env, "")

129 + }

130 +

131 + fsrv := FileServer{Root: "."}

132 + ctx, _ := caddy.NewContext(caddy.Context{Context: context.Background()})

133 + if err := fsrv.Provision(ctx); err != nil {

134 + t.Fatal(err)

135 + }

136 +

137 + key := filepath.Join("caddy", "certificates", "local", "localhost", "localhost.key")

138 + if !fileHidden(key, fsrv.Hide) {

139 + t.Errorf("%s is not hidden; hide list: %v", key, fsrv.Hide)

140 + }

141 + if fileHidden("caddyfile.go", fsrv.Hide) {

142 + t.Errorf("caddyfile.go is hidden; hide list: %v", fsrv.Hide)

143 + }

144 +}