After pondering #367 for a while, this seemed like a nicer solution
than providing an option to disable this:
wai-app-static is pretty battletested at this point, it’s well
maintained, has relatively few dependencies and it provides some extra
functionality around caching which may be useful.
That way, we avoid our own validation logic which was broken several
times and I’m not surprised if it’s broken again.
This PR does not address haddock: and file: links. Those deliberately
do not limit paths but they are also disabled by default so from a
security pov this is less of an issue.
Thanks for the pull request!
By raising this pull request you confirm you are licensing your contribution under all licenses that apply to this project (see LICENSE) and that you have no patents covering your contribution.
After pondering #367 for a while, this seemed like a nicer solution than providing an option to disable this:
wai-app-static is pretty battletested at this point, it’s well maintained, has relatively few dependencies and it provides some extra functionality around caching which may be useful.
That way, we avoid our own validation logic which was broken several times and I’m not surprised if it’s broken again.
This PR does not address haddock: and file: links. Those deliberately do not limit paths but they are also disabled by default so from a security pov this is less of an issue.
Thanks for the pull request!
By raising this pull request you confirm you are licensing your contribution under all licenses that apply to this project (see LICENSE) and that you have no patents covering your contribution.
If you care, my PR preferences are at https://github.com/ndmitchell/neil#contributions, but they're all guidelines, and I'm not too fussy - you don't have to read them.