Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement a way to restrict static HTML access to directories outside data directory #14

Open
keithrbennett opened this issue Jan 26, 2021 · 0 comments

Comments

@keithrbennett
Copy link
Owner

Regarding this, from the REPORTS.md file:


! Important Security Warning !

The generated HTML files are intended for local and individual use only. For your convenience, they contain links that enable you to navigate your data directories, but also your entire file system. Making your files accessible via a web server or screen sharing would enable the remote user to view all the files on your system and is not recommended! You can give others access to your files safely by instead sending them only the data files, most conveniently in the form of a zip file.


It would be nice to find a way to solve this problem. Possible solutions:

  • use a JavaScript file management widget that can impose this directory restriction (if such a widget exists)
  • find and document a way to confine a browser's environment, possibly by:
    • a command line option to a specific browser application, or
    • an independent sandbox mechanism of some kind (like Docker, but Docker is too heavyweight)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant