Noah Goldsmid

It is possible to read every file on the system using ../ try: [cotix@lithium ~]$ nc localhost 8080 GET /../../../../../../../etc/passwd HTTP/1.0 HTTP/1.0 200 OK Content-Type: text/plain root: x:0:0:root:/root:/bin/bash ... rest...

Our UI lacks

9

I love ncurses, but we cant just dump all comments in one big pile. We need some kind of formatting

Fetch all objects to include in one query to improve performance

1

Using an include results in fetching every object individually, even when this is not necessary. This commit evaluates the given query and uses the resulting objects instead. If your data...

security issue with requests outside of www root

3

It is possible to request parent directories. cotix@lithium:~$ nc localhost 9999 GET /../../../../../etc/passwd HTTP/1.0 HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: no-cache Content-length: 2333 Content-type: text/plain root:x:0:0:root:/root:/bin/bash ... my whole /etc/passwd...

Very simple DoS

1

There seems to be no timeout on the connections. Since every connection takes up a whole thread, this is a very simple DoS vurnability. To make matters worse, because the...