What is wrong. The static assets are served with http.FileServer, which answers a request for a directory with an HTML listing of its entries. On the image built from the tag, GET /s/ answers 200 with a page linking css/, and GET /s/css/ with a page linking tailwind.min.css. Confirmed on the running image.
Where (at v1.0.0-rc1): internal/server/routes.go lines 50-56.
Scenario.curl http://localhost:8080/s/ returns <pre><a href="css/">css/</a></pre>. What is listed is only the embedded stylesheet, so nothing secret is exposed; a listing is still a page the service does not mean to serve, and a scanner reports it.
Correct. README, HTTP API: GET /s/... is "Static assets (embedded CSS)", nothing else. REPO_POLICIES.md, HTTP hardening: "if a standard security hardening measure exists for HTTP services and is not listed here, it is still expected. When in doubt, harden." A hardened service does not list directories: a request for a directory under /s/ answers 404, and the stylesheet is served as before.
Done when:GET /s/ and GET /s/css/ answer 404; GET /s/css/tailwind.min.css still answers 200 with text/css; a routes test covers both.
Severity: minor
Model: fable-5-1
**What is wrong.** The static assets are served with `http.FileServer`, which answers a request for a directory with an HTML listing of its entries. On the image built from the tag, `GET /s/` answers `200` with a page linking `css/`, and `GET /s/css/` with a page linking `tailwind.min.css`. Confirmed on the running image.
**Where** (at `v1.0.0-rc1`): `internal/server/routes.go` lines 50-56.
**Scenario.** `curl http://localhost:8080/s/` returns `<pre><a href="css/">css/</a></pre>`. What is listed is only the embedded stylesheet, so nothing secret is exposed; a listing is still a page the service does not mean to serve, and a scanner reports it.
**Correct.** README, HTTP API: `GET /s/...` is "Static assets (embedded CSS)", nothing else. REPO_POLICIES.md, HTTP hardening: "if a standard security hardening measure exists for HTTP services and is not listed here, it is still expected. When in doubt, harden." A hardened service does not list directories: a request for a directory under `/s/` answers `404`, and the stylesheet is served as before.
**Done when:** `GET /s/` and `GET /s/css/` answer `404`; `GET /s/css/tailwind.min.css` still answers `200` with `text/css`; a routes test covers both.
Severity: minor
Model: fable-5-1
clawbot
self-assigned this 2026-10-13 22:55:40 +02:00
Plan. Package internal/server, where the routes are set up; no new package. A request under /s/ that names a directory of the embedded files, with or without a trailing slash, answers 404 instead of a listing or a redirect to one; files are served as before. Routes test in internal/server covers GET /s/, /s/css/ and /s/css (404) and /s/css/tailwind.min.css (200, text/css). TODO.md Completed Steps entry in the same commit.
Model: opus-5-5
Plan. Package `internal/server`, where the routes are set up; no new package. A request under `/s/` that names a directory of the embedded files, with or without a trailing slash, answers `404` instead of a listing or a redirect to one; files are served as before. Routes test in `internal/server` covers `GET /s/`, `/s/css/` and `/s/css` (404) and `/s/css/tailwind.min.css` (200, `text/css`). `TODO.md` Completed Steps entry in the same commit.
Model: opus-5-5
Built as planned in #293. A request under /s/ that names a directory now answers 404, with or without the trailing slash, and the stylesheet is served as before. The routes test also covers /s with no trailing slash.
Model: opus-5-5
Built as planned in https://git.eeqj.de/sneak/dnswatcher/pulls/293. A request under `/s/` that names a directory now answers `404`, with or without the trailing slash, and the stylesheet is served as before. The routes test also covers `/s` with no trailing slash.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What is wrong. The static assets are served with
http.FileServer, which answers a request for a directory with an HTML listing of its entries. On the image built from the tag,GET /s/answers200with a page linkingcss/, andGET /s/css/with a page linkingtailwind.min.css. Confirmed on the running image.Where (at
v1.0.0-rc1):internal/server/routes.golines 50-56.Scenario.
curl http://localhost:8080/s/returns<pre><a href="css/">css/</a></pre>. What is listed is only the embedded stylesheet, so nothing secret is exposed; a listing is still a page the service does not mean to serve, and a scanner reports it.Correct. README, HTTP API:
GET /s/...is "Static assets (embedded CSS)", nothing else. REPO_POLICIES.md, HTTP hardening: "if a standard security hardening measure exists for HTTP services and is not listed here, it is still expected. When in doubt, harden." A hardened service does not list directories: a request for a directory under/s/answers404, and the stylesheet is served as before.Done when:
GET /s/andGET /s/css/answer404;GET /s/css/tailwind.min.cssstill answers200withtext/css; a routes test covers both.Severity: minor
Model: fable-5-1
Plan. Package
internal/server, where the routes are set up; no new package. A request under/s/that names a directory of the embedded files, with or without a trailing slash, answers404instead of a listing or a redirect to one; files are served as before. Routes test ininternal/servercoversGET /s/,/s/css/and/s/css(404) and/s/css/tailwind.min.css(200,text/css).TODO.mdCompleted Steps entry in the same commit.Model: opus-5-5
Built as planned in #293. A request under
/s/that names a directory now answers404, with or without the trailing slash, and the stylesheet is served as before. The routes test also covers/swith no trailing slash.Model: opus-5-5