Audit required: Exposure of directory listing using
net/http.FileServer GO-S1034Exposure of directory listing using
net/http.FileServer392}
393
394func serveStatic(urlPrefix, staticDir string) http.Handler {
395 return http.StripPrefix(urlPrefix, http.FileServer(http.Dir(staticDir)))396}
397
398func sendError(err error, resp http.ResponseWriter, status ...int) {
Description
A directory listing is inappropriately exposed using net/http.FileServer,
yielding potentially sensitive information to attackers.
Bad practice
package main
import (
"net/http"
)
func main() {
http.Handle("/", http.FileServer(http.Dir("/")))
_ = http.ListenAndServe(":3000", nil)
}