[server] Do not render directory listings for static assets #6764

spalger · 2016-04-04T18:07:09Z

epixa · 2016-04-05T16:47:21Z

src/server/config/schema.js

@@ -52,6 +52,7 @@ module.exports = () => Joi.object({
      disableProtection: Joi.boolean().default(false),
      token: Joi.string().optional().notes('Deprecated')
    }).default(),
+    staticDirectoryListings: Joi.boolean().default(Joi.ref('$dev')),


What does this line do? Make it so that defaults to true when in development and false otherwise?

Yes, it defaults to the value of $dev, which will only be true when in development mode.

With this implementation, it seems impossible to disable the static directory listings in development. Setting server.staticDirectoryListings: false doesn't seem to have any effect in development.

How about we just default this to false and then people can permanently set it in their kibana.dev.yml if they want to change that?

@epixa if the config doesn't work then we have a much bigger issue... I'm giving up on trying to keep it in.

epixa · 2016-04-05T17:36:44Z

When I run this branch locally (without adjusting my config at all), I get an exception on the server whenever I try to access /bundles/:

TypeError: Path must be a string. Received undefined
    at assertPath (path.js:8:11)
    at posix.join (path.js:479:5)
    at LazyOptimizer.<anonymous> (/p/kibana/src/optimize/lazy/lazy_optimizer.js:69:12)
    at [object Generator].next (native)
    at step (/p/kibana/src/optimize/lazy/lazy_optimizer.js:9:273)
    at run (/p/kibana/node_modules/babel-core/node_modules/core-js/modules/es6.promise.js:104:47)
    at /p/kibana/node_modules/babel-core/node_modules/core-js/modules/es6.promise.js:115:28
    at flush (/p/kibana/node_modules/babel-core/node_modules/core-js/modules/$.microtask.js:19:5)
    at nextTickCallbackWith0Args (node.js:415:9)
    at process._tickDomainCallback (node.js:385:13)

epixa · 2016-04-05T17:38:15Z

Hmm, actually.. that appears to be happening on master as well.

epixa · 2016-04-05T17:41:31Z

Well, I can't actually confirm that this works because that exception causes the server to return a 500 error.

epixa · 2016-04-05T17:48:57Z

It looks like the optimizer is getting into this route definition: https://github.com/spalger/kibana/blob/fix/configureDirectoryListings/src/optimize/lazy/lazy_optimizer.js#L72-L86

But asset is undefined since I'm only trying to access /bundles. I'm not sure what the expected behavior is suppose to be or even how this works in prior versions...

epixa · 2016-04-05T23:55:53Z

Alright, all of that is a bug, but it's not caused by this PR.

epixa · 2016-04-06T00:05:32Z

Should we include this config value commented out in the kibana.yml, or do you think it's not important enough?

spalger · 2016-04-06T00:10:09Z

~~I really don't want this to go into the config file (by default). I prefer to only have really important stuff there.~~

This really isn't worth supporting. It's pretty clear that the directory listings are unpopular, and I've never used them or seen them used, so I'm just removing them.

…DirectoryListings

epixa · 2016-04-06T00:27:39Z

👍

epixa · 2016-04-06T00:29:30Z

LGTM

This backport is required to fix a bug with push EUI flyouts before v8.8 release. fixes #157180 ## [`77.1.3`](https://github.com/elastic/eui/tree/v77.1.3) **Bug fixes** - Fixed broken push `EuiFlyout` behavior ([#6764](elastic/eui#6764))

## Summary `eui@77.2.2` ⏩ `eui@79.0.1` 🦴 The primary changes in this upgrade are around the deprecated `EuiLoadingContent` being removed in favor of `EuiSkeletonText`. - Most instances have been a [direct swap of usage](327626a), but [some replacements were a bit more opinionated](e6ceb36) as I saw them as potential to take advantage of `EuiSkeletonText`'s syntactical sugar and screen reader announcements for when state switches to loaded. --- ## [`79.0.1`](https://github.com/elastic/eui/tree/v79.0.1) **Bug fixes** - Fixed broken push `EuiFlyout` behavior ([#6764](elastic/eui#6764)) ## [`79.0.0`](https://github.com/elastic/eui/tree/v79.0.0) - Updated all `EuiSkeleton` components with new props that allow for more control over screen reader live announcements: `announceLoadingStatus`, `announceLoadedStatus`, and `ariaLiveProps` ([#6752](elastic/eui#6752)) - Improved keyboard accessibility in `EuiPageHeader` by ensuring the right side menu items come into focus from left to right. ([#6753](elastic/eui#6753)) **Breaking changes** - Removed deprecated `EuiLoadingContent`. Use the `EuiSkeleton` components instead. ([#6754](elastic/eui#6754)) ## [`78.0.0`](https://github.com/elastic/eui/tree/v78.0.0) - Improved the contrast ratio of `EuiCheckbox`, `EuiRadio`, and `EuiSwitch` in their unchecked states to meet WCAG AA guidelines. ([#6729](elastic/eui#6729)) - Added React Testing Library `*ByTestSubject` custom commands to `within()`. RTL utilities can be imported from `@elastic/eui/lib/test/rtl`. ([#6737](elastic/eui#6737)) - Updated `EuiAvatar` to support a new letter `casing` prop that allow customizing text capitalization ([#6739](elastic/eui#6739)) - Updated `EuiFocusTrap` to support the `gapMode` prop configuration (now defaults to `padding`) ([#6744](elastic/eui#6744)) **Bug fixes** - Fixed inconsistency in `EuiSearchBar`'s AND/OR semantics between DSL and query string generation ([#6717](elastic/eui#6717)) - Fixed `EuiFieldNumber`'s native browser validity detection causing extra unnecessary rerenders ([#6741](elastic/eui#6741)) - Fixed the `scrollLock` property on `EuiFocusTrap` (and other components using `EuiFocusTrap`, such as `EuiFlyout` and `EuiModal`) to no longer block scrolling on nested portalled content, such as combobox dropdowns ([#6744](elastic/eui#6744)) **Breaking changes** - `EuiAvatar`s with the default `user` type will now default to capitalizing all initials in uppercase ([#6739](elastic/eui#6739)) --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

[server] make directory listing configurable

aab257d

spalger assigned epixa Apr 4, 2016

spalger added review v5.0.0 labels Apr 4, 2016

epixa reviewed Apr 5, 2016
View reviewed changes

epixa added updates_needed and removed review labels Apr 6, 2016

epixa assigned spalger and unassigned epixa Apr 6, 2016

spalger added 2 commits April 5, 2016 17:12

Merge branch 'master' of github.com:elastic/kibana into fix/configure…

24c7043

…DirectoryListings

[server] remove directory listing support

8df68fc

spalger added review and removed updates_needed labels Apr 6, 2016

spalger assigned epixa and unassigned spalger Apr 6, 2016

epixa assigned spalger and unassigned epixa Apr 6, 2016

spalger merged commit 2fa1760 into elastic:master Apr 6, 2016

epixa changed the title ~~[server] make directory listing configurable~~ [server] Do not render directory listings for static assets Apr 6, 2016

epixa mentioned this pull request Apr 8, 2016

Disable directory traversal #6832

Closed

epixa added the v5.0.0-alpha2 label Apr 29, 2016

jmcarp mentioned this pull request Jul 22, 2016

Update Kibana to stop exposing directory listings cloud-gov/cg-atlas#129

Open

1 task

spalger deleted the fix/configureDirectoryListings branch October 18, 2019 17:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[server] Do not render directory listings for static assets #6764

[server] Do not render directory listings for static assets #6764

spalger commented Apr 4, 2016

epixa Apr 5, 2016

spalger Apr 5, 2016

epixa Apr 6, 2016

spalger Apr 6, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 6, 2016

spalger commented Apr 6, 2016

epixa commented Apr 6, 2016

epixa commented Apr 6, 2016

[server] Do not render directory listings for static assets #6764

[server] Do not render directory listings for static assets #6764

Conversation

spalger commented Apr 4, 2016

epixa Apr 5, 2016

Choose a reason for hiding this comment

spalger Apr 5, 2016

Choose a reason for hiding this comment

epixa Apr 6, 2016

Choose a reason for hiding this comment

spalger Apr 6, 2016

Choose a reason for hiding this comment

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 5, 2016

epixa commented Apr 6, 2016

spalger commented Apr 6, 2016

epixa commented Apr 6, 2016

epixa commented Apr 6, 2016