Limit exposure to sensitive directories and files

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: javascript-express/access-restriction

Language: JavaScript

Severity: Warning

Category: Security

CWE: 548

Description

Exposing a directory listing could present an attacker an opportunity to access source code or other sensitive data through a file structure exploit. Restricting access to non-sensitive directories and files is strongly suggested.

Learn More

Non-Compliant Code Examples

const express = require("express")
const serveIndex = require("serve-index")

const app = express()

app.use(serveIndex())

Compliant Code Examples

const express = require("express")
const serveIndex = require("serve-index")

const app = express()

app.use(serveIndex("/public"))
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis