Restrict Plack::App::File request methods, GH#660

plack / Plack

PSGI toolkit and server adapters

http://plackperl.org/

Other

486 stars 214 forks source link

Restrict Plack::App::File request methods, GH#660 #662

Closed robrwo closed 3 years ago

robrwo commented 3 years ago

Static file requests (handled by Plack::App::File, which is used by Plack::Middleware::Static) were allowing any request method, including POST or DELETE.

This change only allows GET and HEAD requests. Other requests will receive a HTTP 405 error.

Fixes #660.