RFC 1945                        HTTP/1.0                        May 1996


12.5  Attacks Based On File and Path Names

   Implementations of HTTP origin servers should be careful to restrict
   the documents returned by HTTP requests to be only those that were
   intended by the server administrators. If an HTTP server translates
   HTTP URIs directly into file system calls, the server must take
   special care not to serve files that were not intended to be
   delivered to HTTP clients. For example, Unix, Microsoft Windows, and
   other operating systems use ".." as a path component to indicate a
   directory level above the current one. On such a system, an HTTP
   server must disallow any such construct in the Request-URI if it
   would otherwise allow access to a resource outside those intended to
   be accessible via the HTTP server. Similarly, files intended for
   reference only internally to the server (such as access control
   files, configuration files, and script code) must be protected from
   inappropriate retrieval, since they might contain sensitive
   information. Experience has shown that minor bugs in such HTTP server
   implementations have turned into security risks.

13.  Acknowledgments

   This specification makes heavy use of the augmented BNF and generic
   constructs defined by David H. Crocker for RFC 822 [7]. Similarly, it
   reuses many of the definitions provided by Nathaniel Borenstein and
   Ned Freed for MIME [5]. We hope that their inclusion in this
   specification will help reduce past confusion over the relationship
   between HTTP/1.0 and Internet mail message formats.

   The HTTP protocol has evolved considerably over the past four years.
   It has benefited from a large and active developer community--the
   many people who have participated on the www-talk mailing list--and
   it is that community which has been most responsible for the success
   of HTTP and of the World-Wide Web in general. Marc Andreessen, Robert
   Cailliau, Daniel W. Connolly, Bob Denny, Jean-Francois Groff, Phillip
   M. Hallam-Baker, Hakon W. Lie, Ari Luotonen, Rob McCool, Lou
   Montulli, Dave Raggett, Tony Sanders, and Marc VanHeyningen deserve
   special recognition for their efforts in defining aspects of the
   protocol for early versions of this specification.

   Paul Hoffman contributed sections regarding the informational status
   of this document and Appendices C and D.











 
RFC 1945                        HTTP/1.0                        May 1996


   This document has benefited greatly from the comments of all those
   participating in the HTTP-WG. In addition to those already mentioned,
   the following individuals have contributed to this specification:

       Gary Adams                         Harald Tveit Alvestrand
       Keith Ball                         Brian Behlendorf
       Paul Burchard                      Maurizio Codogno
       Mike Cowlishaw                     Roman Czyborra
       Michael A. Dolan                   John Franks
       Jim Gettys                         Marc Hedlund
       Koen Holtman                       Alex Hopmann
       Bob Jernigan                       Shel Kaphan
       Martijn Koster                     Dave Kristol
       Daniel LaLiberte                   Paul Leach
       Albert Lunde                       John C. Mallery
       Larry Masinter                     Mitra
       Jeffrey Mogul                      Gavin Nicol
       Bill Perry                         Jeffrey Perry
       Owen Rees                          Luigi Rizzo
       David Robinson                     Marc Salomon
       Rich Salz                          Jim Seidman
       Chuck Shotton                      Eric W. Sink
       Simon E. Spero                     Robert S. Thau
       Francois Yergeau                   Mary Ellen Zurko
       Jean-Philippe Martin-Flatin

14. References

   [1]  Anklesaria, F., McCahill, M., Lindner, P., Johnson, D.,
        Torrey, D., and B. Alberti, "The Internet Gopher Protocol: A
        Distributed Document Search and Retrieval Protocol", RFC 1436,
        University of Minnesota, March 1993.

   [2]  Berners-Lee, T., "Universal Resource Identifiers in WWW: A
        Unifying Syntax for the Expression of Names and Addresses of
        Objects on the Network as used in the World-Wide Web",
        RFC 1630, CERN, June 1994.