projectdiscovery/simplehttpserver

SimpleHTTPServer accept serving symlinks that can allow accessing files/folder outside the path

DEMON1A opened this issue · 0 comments

After reviewing the server. i noticed that the server reads the symlinks and serve them on the server according to the files inside of the path. serving symlinks isn't secure in this case that can result in security issues in some cases. in most applications symlinks is enabled according to the user options. if they need it. so creating a command -allow-symlink will be more secure in this case.