mirror of https://github.com/yandex/gixy
Add hint toaliastraversal documentation
Document on what to do if an alias points to a file and should thus not end with a /pull/100/head
parent
3b2713b537
commit
fa9315ca6a
|
@ -23,3 +23,4 @@ In other words, the incorrect configuration of `alias` could allow an attacker t
|
|||
It's pretty simple:
|
||||
- you must find all the `alias` directives;
|
||||
- make sure that the parent prefixed location ends with directory separator.
|
||||
- or if you want to map a signle file make sure the location starts with a `=`, e.g `=/i.gif` instead of `/i.gif`.
|
||||
|
|
Loading…
Reference in New Issue