search

lovasoa / SQLpage

SQL-only webapp builder, empowering data analysts to build websites and applications quickly
https://sql.datapage.app
MIT License
1.29k stars 69 forks source link

The sqlpage folder can be read by HTTP client requests #89

Closed olivierauverlot closed 11 months ago

olivierauverlot commented 11 months ago

With the browser, we can download the files in the sqlpage folder. For example, it's possible to read the sqlpage.json configuration file. It's a security problem. The sqlpage folder must be keep hidden.

It's possible to set rewrite rules on the proxy side to block the download. But, I think that it will be cool to filter url in sqlpage server.

lovasoa commented 11 months ago

Thank you very much for the report. The check was removed during a refactoring and we missed it because we didn't have a test for it. I'll release a new version today.

lovasoa commented 11 months ago

Just released v0.11.1

lovasoa commented 11 months ago

I published an advisory and requested a CVE, where you will be credited.

https://github.com/lovasoa/SQLpage/security/advisories/GHSA-v5wf-jg37-r9m5