abhinav-phi commented on PR #2124: URL: https://github.com/apache/stormcrawler/pull/2124#issuecomment-5601251017
Both follow-ups addressed in 82a8d10a: - **@dpol1** the symlink test now asserts `403` (`assertEquals`) rather than not-200 — which is the root-confinement rejection and is distinguishable from the 300 the canonical-path branch returns for a symlink that stays inside the root. - **@rzo1** `fileProtocolRejectsHostComponents` now serves a real file placed *inside* the configured root, requested as `file://evil.example.com/inside.txt`. Without the host check it resolves to that readable file and returns 200, so the `403` is pinned to the host check itself. `configuration.adoc` updated: `protocols` now shows `http,https` as the shipped default and `file.protocol.root` is documented (confinement, symlinks escaping the root, host components, and that the file scheme serves nothing without a root). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
