PlugStaticLs
Directory Index for Plug/Phoenix Static Assets
WARNING: inherent vulnerability regarding directory listing
Providing directory listing may reveal following vulnerabilities:
- Contents of unintended files left in the directory will be shown to the HTTP clients.
- Directory listing requires file stat operations and may result in consuming computing resources.
Do not provide directory listing unless you are 100% sure about the contents in the directory.
Installation
If available in Hex, the package can be installed as:
Add
plug_static_ls
to your list of dependencies inmix.exs
:def deps do [{:plug_static_ls, "~> 0.1.0"}] end
Ensure
plug_static_ls
is started before your application:def application do [applications: [:plug_static_ls]] end
Prerequisites
The filename locale of the Erlang VM must be explicitly specified to UTF-8.
See Erlang’s erl +fnu
option description for the details.
Note: Elixir assumes UTF-8 usage on the filenames and internal strings.
Usage
Add PlugStaticLs
after Plug.Static
in endpoint.ex
plug Plug.Static, at: "/", from: :my_app
plug PlugStaticLs, at: "/", from: :my_app, only: ~w(with_listing)
# Note: non-existent file will be routed here
# Explicit plug to catch this case is required
License
Acknowledment
The basic skeleton of this package is derived from
static.ex
aka Plug.Static
module of the Plug repository.
The directory listing page design is derived from Yaws Web Server.