fix: preventing inappropriate directory access and listings

[henriquesebastiao]

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Improvement (refactoring and improving code)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Description

This PR prevents the site user from being able to access directories that they should not have access to, such as the path /assets/css/, it is possible to access this path as seen in the image below.

This behavior occurs with the following paths:

• /assets/css/
• /assets/img/
• /assets/js/

To fix this I adjusted the /assets/404.html file so that the user is redirected to the 404 error page if they try to access any of the paths mentioned above.

Additional context

I noticed this problem because in my project I noticed that when trying to access /Makefile in the browser, I was able to download the file, so I figured it might not be the only file with this problem.

Looking for more accessible paths with dirb we have the following report:

When running dirb http://127.0.0.1:4000/ /usr/share/wordlists/dirb/common.txt

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Thu Mar 20 15:45:18 2025
URL_BASE: http://127.0.0.1:4000/
WORDLIST_FILES: /usr/share/wordlists/dirb/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://127.0.0.1:4000/ ----
+ http://127.0.0.1:4000/404 (CODE:200|SIZE:17485)                                                                                                                                                                                                                                        
==> DIRECTORY: http://127.0.0.1:4000/about/                                                                                                                                                                                                                                              
==> DIRECTORY: http://127.0.0.1:4000/archives/                                                                                                                                                                                                                                           
==> DIRECTORY: http://127.0.0.1:4000/assets/                                                                                                                                                                                                                                             
==> DIRECTORY: http://127.0.0.1:4000/categories/                                                                                                                                                                                                                                         
+ http://127.0.0.1:4000/index (CODE:200|SIZE:24206)                                                                                                                                                                                                                                      
+ http://127.0.0.1:4000/index.html (CODE:200|SIZE:24206)                                                                                                                                                                                                                                 
==> DIRECTORY: http://127.0.0.1:4000/posts/                                                                                                                                                                                                                                              
+ http://127.0.0.1:4000/robots.txt (CODE:200|SIZE:80)                                                                                                                                                                                                                                    
+ http://127.0.0.1:4000/sitemap.xml (CODE:200|SIZE:1646)                                                                                                                                                                                                                                 
==> DIRECTORY: http://127.0.0.1:4000/tags/                                                                                                                                                                                                                                               
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/about/ ----
+ http://127.0.0.1:4000/about/index (CODE:200|SIZE:17781)                                                                                                                                                                                                                                
+ http://127.0.0.1:4000/about/index.html (CODE:200|SIZE:17781)                                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/archives/ ----
+ http://127.0.0.1:4000/archives/index (CODE:200|SIZE:17980)                                                                                                                                                                                                                             
+ http://127.0.0.1:4000/archives/index.html (CODE:200|SIZE:17980)                                                                                                                                                                                                                        
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/assets/ ----
==> DIRECTORY: http://127.0.0.1:4000/assets/css/                                                                                                                                                                                                                                         
==> DIRECTORY: http://127.0.0.1:4000/assets/img/                                                                                                                                                                                                                                         
+ http://127.0.0.1:4000/assets/index (CODE:200|SIZE:465)                                                                                                                                                                                                                                 
+ http://127.0.0.1:4000/assets/index.html (CODE:200|SIZE:465)                                                                                                                                                                                                                            
==> DIRECTORY: http://127.0.0.1:4000/assets/js/                                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/categories/ ----
==> DIRECTORY: http://127.0.0.1:4000/categories/demo/                                                                                                                                                                                                                                    
+ http://127.0.0.1:4000/categories/index (CODE:200|SIZE:18540)                                                                                                                                                                                                                           
+ http://127.0.0.1:4000/categories/index.html (CODE:200|SIZE:18540)                                                                                                                                                                                                                      
==> DIRECTORY: http://127.0.0.1:4000/categories/tutorial/                                                                                                                                                                                                                                
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/posts/ ----
+ http://127.0.0.1:4000/posts/index (CODE:200|SIZE:465)                                                                                                                                                                                                                                  
+ http://127.0.0.1:4000/posts/index.html (CODE:200|SIZE:465)                                                                                                                                                                                                                             
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/tags/ ----
+ http://127.0.0.1:4000/tags/index (CODE:200|SIZE:16954)                                                                                                                                                                                                                                 
+ http://127.0.0.1:4000/tags/index.html (CODE:200|SIZE:16954)                                                                                                                                                                                                                            
==> DIRECTORY: http://127.0.0.1:4000/tags/writing/                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/assets/css/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/assets/img/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/assets/js/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/categories/demo/ ----
+ http://127.0.0.1:4000/categories/demo/index (CODE:200|SIZE:16995)                                                                                                                                                                                                                      
+ http://127.0.0.1:4000/categories/demo/index.html (CODE:200|SIZE:16995)                                                                                                                                                                                                                 
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/categories/tutorial/ ----
+ http://127.0.0.1:4000/categories/tutorial/index (CODE:200|SIZE:17817)                                                                                                                                                                                                                  
+ http://127.0.0.1:4000/categories/tutorial/index.html (CODE:200|SIZE:17817)                                                                                                                                                                                                             
                                                                                                                                                                                                                                                                                         
---- Entering directory: http://127.0.0.1:4000/tags/writing/ ----
+ http://127.0.0.1:4000/tags/writing/index (CODE:200|SIZE:16968)                                                                                                                                                                                                                         
+ http://127.0.0.1:4000/tags/writing/index.html (CODE:200|SIZE:16968)                                                                                                                                                                                                                    
                                                                                                                                                                                                                                                                                         
-----------------
END_TIME: Thu Mar 20 15:45:44 2025
DOWNLOADED: 46120 - FOUND: 23

If the developer creates other files in the project root, or in a /assets/new-folder folder, these will also be accessible, perhaps it would be interesting to warn about this in the documentation.

[henriquesebastiao]

Other paths that are also accessible:

• /assets/img/favicons/
• /assets/js/data/
• /assets/js/dist/

[cotes2020]

Actually, the plugin jekyll-redirect-from is not very useful for hiding web site directories, and can even be completely removed from the project without any problems.

If the site is hosted on a platform such as GitHub Pages, it will automatically jump to a 404 when accessing a page that doesn't exist, you can verify this by visiting https://chirpy.cotes.page/assets/css/. If the site is hosted on a private server, we can configure the web server to hide specific file paths.

[henriquesebastiao]

I understand, it was my lack of knowledge then. I thought it would behave the same way in cases of deployment even if they were not behind a web server. In my case, I am deploying with Cloudflare Pages, and testing now, these accesses are also redirected to 404. I am closing this.