search

davtur19 / DotGit

An extension for checking if .git is exposed in visited websites
GNU General Public License v3.0
372 stars 32 forks source link

git folder not found if on a subpath #8

Closed notdodo closed 3 years ago

notdodo commented 3 years ago

Hi!

It's seems that the extension is not able to detect a .git folder if is a subpath.

For example the site https://fossies.org/ has a .git folder on the path https://fossies.org/linux/knock/.git/logs/HEAD

davtur19 commented 3 years ago

Hi,

It is intended behavior, because otherwise the extension would have to make too many requests.

It would mean making a request every time the browser makes a request, so the browser has to double the requests, and it would slow down the browser a lot.

Alternatively I could save the requests already made so as not to repeat them (as already happens for domains), but in any case they would still be almost double the requests, in addition to occupying a lot of memory and saving sensitive data.

So the best solution I think is not to implement such a thing, as it should be quite rare to find a .git into a subdirectory.

notdodo commented 3 years ago

Hi!

I understand the problem and thank you for the explanation although is not that rare (i.e. reverse proxy to multiple apps or plugins/dependencies used in the webapp, a simple google dork can help you find them).

Anyway I don't want to force you to implement this, your choice :)

EDIT: maybe a switch to enable/disable this feature?

davtur19 commented 3 years ago

If I put a switch, it wouldn't be something you should normally use while using the browser, you should only use it on a specific site, and at this point it would make more sense to use a dirscan tool.