From b6cfed16affc31abdc74913d94ad63cbdb7fe4fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Dunglas?= Date: Sun, 1 Nov 2026 21:57:49 +0100 Subject: [PATCH] fileserver: hide the data directory when it is relative (#8327) (cherry picked from commit 9dd12fdb5d975d23a581897149d14d7186747634) --- modules/caddyhttp/fileserver/staticfiles.go | 7 +++++++ .../fileserver/staticfiles_hide_test.go | 20 +++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/modules/caddyhttp/fileserver/staticfiles.go b/modules/caddyhttp/fileserver/staticfiles.go index d1346c91f..1fcc0ce23 100644 --- a/modules/caddyhttp/fileserver/staticfiles.go +++ b/modules/caddyhttp/fileserver/staticfiles.go @@ -210,6 +210,13 @@ func (fsrv *FileServer) Provision(ctx caddy.Context) error { fsrv.IndexNames = defaultIndexNames } + // a relative data directory sits under the working directory and holds private keys + if dataDir := caddy.AppDataDir(); !filepath.IsAbs(dataDir) { + if abs, err := caddy.FastAbs(dataDir); err == nil { + fsrv.Hide = append(fsrv.Hide, abs) + } + } + // for hide paths that are static (i.e. no placeholders), we can transform them into // absolute paths before the server starts for very slight performance improvement for i, h := range fsrv.Hide { diff --git a/modules/caddyhttp/fileserver/staticfiles_hide_test.go b/modules/caddyhttp/fileserver/staticfiles_hide_test.go index 2f037b3a1..d51456f4a 100644 --- a/modules/caddyhttp/fileserver/staticfiles_hide_test.go +++ b/modules/caddyhttp/fileserver/staticfiles_hide_test.go @@ -122,3 +122,23 @@ func TestBrowseHidesPathQualifiedEntries(t *testing.T) { }) } } + +func TestHideRelativeDataDir(t *testing.T) { + for _, env := range []string{"XDG_DATA_HOME", "HOME", "AppData", "HOMEDRIVE", "HOMEPATH", "USERPROFILE", "home"} { + t.Setenv(env, "") + } + + fsrv := FileServer{Root: "."} + ctx, _ := caddy.NewContext(caddy.Context{Context: context.Background()}) + if err := fsrv.Provision(ctx); err != nil { + t.Fatal(err) + } + + key := filepath.Join("caddy", "certificates", "local", "localhost", "localhost.key") + if !fileHidden(key, fsrv.Hide) { + t.Errorf("%s is not hidden; hide list: %v", key, fsrv.Hide) + } + if fileHidden("caddyfile.go", fsrv.Hide) { + t.Errorf("caddyfile.go is hidden; hide list: %v", fsrv.Hide) + } +}