Container serves the .git directory

x86dev / docker-ttrss

Tiny Tiny RSS feed reader as a Docker image.

54 stars 41 forks source link

Container serves the .git directory #42

Open languitar opened 4 years ago

languitar commented 4 years ago

In the current configuration, the created container serves the .git directory of tt-rss. This is probably not a real issue for an open source project with no private commits, but I just got an automated notification from "Deutsche Gesellschaft für Cybersicherheit", who scanned the web for potentially vulnerable servers (https://www.heise.de/ct/artikel/Massive-Sicherheitsprobleme-durch-offene-Git-Repositorys-4795181.html, German only).

x86dev commented 2 years ago

Yeah, I've read the article as well -- we might want to further protect that directory and/or move it further down, so that the web server only serves a copy of of the (needed) content.