Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's clear the problem involves some PHP sites developed with git and instead of using a specific www directory inside the project the server points to the root folder of the project thus exposing .git (and the rest). Classic dumb error by PHP developers. I have hard time believing one would be able to expose the .git folder in a Rails,Spring or Django application since the public folder isn't the root folder of the project.

I wish servers would be configured so they don't server ^\..+$ files by default. I wish servers would behave as secure as possible then it's up to the developer to whitelist features rather than the other way around.



Excluding anything that starts with a period also doesn't work - RFC 5785 specs the folder .well-known with special meaning.


True, but you can whitelist /.well-known/. I don't think anything else uses dot-filenames in URLs, because not all operating systems and software even allow such file names (for instance, the file browser in Windows forbids it when creating a new file or folder).


PHP? Static sites, ASP sites, CGI sites, these would also be vulnerable. Don't be so quick to laugh.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: