Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exception when when accessing a folder that is missing permissions #103

Closed
HeapUnderfl0w opened this issue Apr 22, 2020 · 5 comments
Closed
Labels

Comments

@HeapUnderfl0w
Copy link

HeapUnderfl0w commented Apr 22, 2020

This issue ties in with #94 .
This has been tested under x86_64 Linux, but is probably also the case under other platforms.

General Info

  • Kernel: Linux hzd 5.6.4-arch1-1 #1 SMP PREEMPT Mon, 13 Apr 2020 12:21:19 +0000 x86_64 GNU/Linux
  • http: http 1.9.1

Error

given a folder tree similar to this

.
|-- [-rw-r--r-- aloy    ]  a.txt
|-- [drwx------ root    ]  not_work
|   `-- [-rw-r--r-- root    ]  c.txt
`-- [drwxr-xr-x aloy    ]  works
    `-- [-rw-r--r-- aloy    ]  b.txt

when running http as user aloy, it will error when attempting to access the not_work folder instead of returning a sensible status code like 403: Forbidden.

Hosting "." on port 8000 without TLS and no authentication...
Ctrl-C to stop.

[2020-04-22 12:35:19] 127.0.0.1:51948 was served directory listing for /tmp/example
[2020-04-22 12:35:19]                           encoded as gzip for 336.6% ratio
[2020-04-22 12:35:24] 127.0.0.1:51948 was served file /tmp/example/a.txt as text/plain
[2020-04-22 12:35:24] 127.0.0.1:51948 requested to GET nonexistent entity /tmp/example/favicon.ico
[2020-04-22 12:35:24]                           encoded as gzip for 519.4% ratio
[2020-04-22 12:35:27] 127.0.0.1:51948 was served directory listing for /tmp/example/not_work
thread '<unnamed>' panicked at 'Failed to read requested directory: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }', /home/aloy/.cargo/registry/src/github.com-1ecc6299db9ec823/https-1.9.1/src/ops/mod.rs:841:22
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Reproducing

  1. Take any folder structure which contains a folder/file which the executing user has no access permissions for.
  2. Run http in that directory with no arguments
  3. Navigate over a browser or other tools to the folder with the permission issue

EDIT: Clarified example

@nabijaczleweli
Copy link
Collaborator

Yeah, I remember a similar thing happening some time in past on Windows 10 with its C:/ protections; I think I fixed that particular case but this codebase has a nasty trend of panicking instead of handling errors right, mistakes of my youth and all that.

Thanks for the test-case, I'll look into it!

@nabijaczleweli
Copy link
Collaborator

Would you be so kind so as to try the commit referenced above? Should also fix files marked, similarly to the example, 600 and root.

Also, I really like that tree view – is that a mock-up, or is there a tool that draws them like this?

@HeapUnderfl0w
Copy link
Author

Would you be so kind so as to try the commit referenced above? Should also fix files marked, similarly to the example, 600 and root.

i expanded the example to all the edge cases i could think off of the top of my head,
and it seems to work decent with all of them:

.
|-- [-rw-r--r-- aloy    ]  a.txt
|-- [drwx------ root    ]  different_user_no_access
|   `-- [-rw-r--r-- root    ]  c.txt
|-- [-rw------- root    ]  forbidden_file.txt
|-- [drwxr-xr-x aloy    ]  same_user_access
|   `-- [-rw-r--r-- aloy    ]  b.txt
`-- [d--------- aloy    ]  same_user_but_no_access
    `-- [-rw-r--r-- aloy    ]  d.txt

Also, I really like that tree view – is that a mock-up, or is there a tool that draws them like this?

no this is not a mock up, it is created with the linux utility tree. The examples specifically are generated with sudo tree --charset ascii -pu

@nabijaczleweli
Copy link
Collaborator

Alright, great! Thanks for testing and letting me know about the tree switches, they'll definitely come useful in future!

@nabijaczleweli
Copy link
Collaborator

Released in v1.9.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants