Security

File System

You can use omnisrv in a sandbox.

With omnisrv-9p, you can use a secure static file server, while the underlying mounted 9P file system has dynamic read-only files.

If you have serious security concerns, use omnisrv-ssg with a secure static file server, or just use something else you trust.

Leakage

Consider these symlinks:

ln -s site_source site
ln -s index.md site/also-index.md
ln -s /etc/passwd site_source/passwd.txt
omnisrv site

In this case, site and site/also-index.md are followed by omnisrv (in scope), but site/passwd.txt is NOT followed. (per os.Root)

dotgit

/.git paths are masked (respond 404) by omnisrv. .git in subdirectories (if any) are still visible.

Also mask sensitive paths in your reverse proxy too.

Injection

omnisrv doesn’t take anything from URL Queries, HTTP request headers, or POST body, except for logging.

Also, fasthttp and net/http sanitize request path. Any remote injection attempts should fail.

omnisrv keeps HTML in markdown as-is without escaping. Templates can use {{.UnsafeHtml "..."}}.

Keep your site files yourself. Audit third-party templates. Only host trusted content.

CSP

At the moment, omnisrv doesn’t send a Content-Security-Policy header.

If necessary, configure it in reverse proxy.

Network

Any local user can dial loopback TCP addresses.

You can listen on a unix socket, as long as reverse proxy supports it.

mkdir /var/lib/omnisrv
chmod 700 /var/lib/omnisrv
chown omnisrv:omnisrv /var/lib/omnisrv
# Socket permission is 0o700 by default
omnisrv -proto unix -addr /var/lib/omnisrv/http.socket site

This applies to 9P too. Mount with address unix!/path/to/socket.

omnisrv-9p -proto unix -addr /var/lib/omnisrv/9p.socket site

Unsafe

omnisrv (HTTP server only) has zero-copy bytes-to-string (mutable-to-immutable) conversion with unsafe, which is audited to be safe.

You can disable unsafe usages with build flag nounsafe.

This only applies to first-party (omnisrv). As fasthttp also uses unsafe, you can additionally add build flag gohttp.