Skip to main content

Module file

Module file 

Available on crate features http and std only.
Expand description

Serve file:// request URIs from the local filesystem.

A client stack layered with FileUriLayer answers file:// requests itself and passes every other scheme to the inner service, so one client serves both local and remote URIs.

Place this layer outside any FollowRedirectLayer: redirects are followed by the inner service, so a remote response can never redirect into the local filesystem.

This is a client-side layer: the request target is your own. Mounting it in a server stack, where the request target is attacker-controlled, turns any absolute-form file:// target into an arbitrary local-file read. If you must, always confine it with FileUriLayer::with_jail; the default (None) serves any readable absolute path.

Structs§

FileUriLayer
Serve file:// request URIs from the local filesystem.
FileUriService
Serve file:// request URIs from the local filesystem.