diff --git a/docs/static-files.md b/docs/static-files.md index 3ecab8d..e240486 100644 --- a/docs/static-files.md +++ b/docs/static-files.md @@ -10,15 +10,20 @@ It is possible to serve static files with a custom path pattern and `NamedFile`. +:::warning +Matching a path tail with the `[.*]` regex and using it to return a `NamedFile` has serious security implications. +It offers the possibility for an attacker to insert `../` into the URL and access every file on the host that the user running the server has access to. +::: + ## Directory -To serve files from specific directories and sub-directories, `Files` can be used. `Files` must be registered with an `App::service()` method, otherwise it will be unable to serve sub-paths. +To serve files from specific directories and sub-directories, [`Files`][files] can be used. `Files` must be registered with an `App::service()` method, otherwise it will be unable to serve sub-paths. -By default files listing for sub-directories is disabled. Attempt to load directory listing will return _404 Not Found_ response. To enable files listing, use [_Files::show_files_listing()_][showfileslisting] method. +By default files listing for sub-directories is disabled. Attempt to load directory listing will return _404 Not Found_ response. To enable files listing, use [`Files::show_files_listing()`][showfileslisting] method. -Instead of showing files listing for directory, it is possible to redirect to a specific index file. Use the [_Files::index_file()_][indexfile] method to configure this redirect. +Instead of showing files listing for a directory, it is possible to redirect to a specific index file. Use the [`Files::index_file()`][indexfile] method to configure this redirect. ## Configuration @@ -36,5 +41,6 @@ The Configuration can also be applied to directory service: -[showfileslisting]: https://docs.rs/actix-files/0.2/actix_files/struct.Files.html -[indexfile]: https://docs.rs/actix-files/0.2/actix_files/struct.Files.html#method.index_file +[files]: https://docs.rs/actix-files/0.6/actix_files/struct.Files.html# +[showfileslisting]: https://docs.rs/actix-files/0.6/actix_files/struct.Files.html#method.show_files_listing +[indexfile]: https://docs.rs/actix-files/0.6/actix_files/struct.Files.html#method.index_file