Uploaded image for project: 'OpenShift GitOps'
  1. OpenShift GitOps
  2. GITOPS-7923

Disable directory listing in ArgoCD server

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Low

      Description of Problem

      • Currently, the ArgoCD server will serve files on directories, potentially exposing files unexpectedly.

      Problem Reproduction

      • After deploying the latest version of GitOps, curl the server for the assets directory will return its files.

      Reproducibility

      • Always

      Prerequisites/Environment

      • Appears present in all installs of OpenShift GitOps, tested with OCP 4.18 and GitOps 1.17.0

      Steps to Reproduce

      • Deploy OpenShift GitOps on the latest version, and curl the ArgoCD for the assets directory: 
        $ curl https://<argocd-server-url>/assets/

      Expected Results

      • No results from the directory:
      $ curl https://<argocd-server-url>/assets/

      Actual Results

      • Files within the directory are displayed:
      $ curl https://<argocd-server-url>/assets/
<!doctype html>
<meta name="viewport" content="width=device-width">
<pre>
<a href="favicon/">favicon/</a>
<a href="fonts/">fonts/</a>
<a href="fonts.css">fonts.css</a>
<a href="images/">images/</a>
<a href="scripts/">scripts/</a>
</pre>

              kykchong@redhat.com Keith Chong
              rhn-support-jorbell Jordan Bell
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: