You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,14 +25,14 @@ For help type **erised -h**
25
25
26
26
When executing **erised** with no parameters, the server will listen on port **8080** for incoming http requests.
27
27
28
-
If you're using the _-path_ option, please **EXERCISE GREAT CAUTION** when setting the path to search. See **Known Issues** for more information.
28
+
If you're using the _-path_ option, please **EXERCISE GREAT CAUTION** when setting the path to search. See **Known Issues** for more information. For security reasons, path is restricted to the directory or subdirectories where the program was invoked.
29
29
30
30
The latest version is also available as a Docker image at [edaddario/erised](https://hub.docker.com/r/edaddario/erised).
31
31
32
32
To start the server in a docker container, with defaults values, execute the following command:
33
33
34
34
```sh
35
-
docker run --rm -p 8080:8080 --name erised edaddario/erised
35
+
docker run --rm -p 8080:8080 --name erised edaddario/erised [flags]
36
36
```
37
37
38
38
If you would like to return file based responses (_X-Erised-Response-File_ set) when using the docker image, you'll need to map the directory containing your local files and set the _-path_ option accordingly.
@@ -104,6 +104,7 @@ NetworkAuthenticationRequired or 511
104
104
Any other value will resolve to 200 (OK)
105
105
106
106
# Release History
107
+
* v0.7.0 - Improve response file processing and security, change logging type, and minor source code readability changes
107
108
* v0.6.11 - Further server shutdown improvements, minor efficiency improvements, general code refactoring and bug fixes
108
109
* v0.6.7 - Improve server shutdown handling, and restrict allowed methods for _erised/headers_, _erised/ip_, _erised/info_ and _erised/shutdown_ routes
109
110
* v0.5.4 - Update dependencies
@@ -122,7 +123,7 @@ Any other value will resolve to 200 (OK)
122
123
**erised** may be full of bugs. Poeple "_... have wasted away before it, not knowing if what they have seen is real, or even possible..._" so, use it with caution for it gives no knowledge or truth.
123
124
124
125
Of all of its deficiencies, the most notable is:
125
-
* Using the _-path_ option could lead to significant security risks. By default, **erised** sets this option to point to the same directory in which is running and, when the _X-Erised-Response-File_ header is set, it will search recursively for a matching filename in the current directory and**all** subdirectories underneath, returning the contents of the first match. For example, if you set this value to your root directory (_-path=/_) **erised** will scan the entire volume for a match
126
+
* Using the _-path_ option could lead to significant security risks. When the _X-Erised-Response-File_ header is set it will search recursively for a matching filename in the current directory or**all** subdirectories underneath, returning the contents of the first match. For security reasons, path is restricted to the directory or subdirectories where the program was invoked.
126
127
* https protocol is not yet supported
127
128
128
129
I may or may not address these issues in a future release. Caveat Emptor
0 commit comments