Disable directory listing for StaticResource

changelog.d/15438.misc

@@ -0,0 +1 @@
+Disable directory listing for static resources in `/_matrix/static/`.

synapse/http/server.py

@@ -569,6 +569,9 @@ def render_GET(self, request: Request) -> bytes:
         set_clickjacking_protection_headers(request)
         return super().render_GET(request)
 
+    def directoryListing(self) -> resource.NoResource:
+        return self.childNotFound
+
 
 class UnrecognizedRequestResource(resource.Resource):
     """