-
Notifications
You must be signed in to change notification settings - Fork 53
TWA 0409
"Build file being served at: ${url}"
In the message output the variable ${url} is replaced by the served URL of the build file.
Files of the build system (e.g. Docker compose, make, CMake) used to setup the web server or other applications running on the server should not be published by the web server. A possible attacker should not get information of the internal settings and structure of the web server and the web applications.
Current (August 2020) the twa script checks the files: 'Dockerfile', 'docker-compose.yml', 'Makefile' and 'CMakeLists.txt'.
Configure the web server to not publish files with internal data.
There exists several configuration options to suppress files with name (pattern) in a blacklist or files not in whitelist. Search the web for examples.