Fluid Attacks Database

Need

Disabling of directory listings on static file routes

Context

• Usage of Rust 1.75+ for building application services

• Usage of the actix-web crate for handling HTTP requests

• Usage of the actix-files crate for serving static files

Description

1. Non compliant code

use actix_files::Files;
use actix_web::web;

fn configure(cfg: &mut web::ServiceConfig) {
    // Any request to a directory returns a browsable index of its files
    cfg.service(Files::new("/static", "./public").show_files_listing());
}

The `configure` function below mounts the `./public` directory at `/static` with `actix_files::Files` and calls `show_files_listing()`. With listing enabled, a request to `/static/` or to any subdirectory returns an HTML index of every file it contains. Files that were never linked from the application become easy to find: a forgotten `backup.zip`, a `.env` copy, a database export, source maps or configuration left by a build step. The listing also reveals the structure of the deployment and the names of internal tools, which helps an attacker plan the next step. Security through unlinked URLs is weak, but a listing removes even that: anyone can browse and download everything under the mount point.

2. Steps

• Remove `show_files_listing()` from every `actix_files::Files` service.

• Serve a fixed page with `index_file` when a directory must answer requests.

• Keep the default `use_hidden_files(false)` so dotfiles are never served.

• Serve only a directory that contains build output meant to be public, and store backups, exports and configuration outside it.

• Periodically request the static mount points without a file name to confirm they do not return a file listing.

3. Secure code example

use actix_files::Files;
use actix_web::web;

fn configure(cfg: &mut web::ServiceConfig) {
    // Exact paths only, a fixed index page, and no hidden files
    cfg.service(Files::new("/static", "./public").index_file("index.html"));
}

The corrected configuration removes `show_files_listing()`. Without it, `actix-files` serves a file only when the request names its exact path, and never renders the contents of a directory. `index_file("index.html")` serves a fixed entry page when a directory is requested, and `use_hidden_files` stays at its default of `false`, so dotfiles such as `.env` or `.git` are never served even if they end up in the directory. Removing the listing does not make private files safe: the served directory should contain only files meant to be public, produced by the build, and backups or exports should be stored outside it.

References

• 125. Directory listing