Access to files outside the playground project
MrErlison opened this issue · comments
When I was studying templates, I made an example with the text/template package and was able to read some files from the playground operating system, such as hosts, /proc/ etc.
@MrErlison did you ran the program on a server environment?
![image](https://private-user-images.githubusercontent.com/9203548/298307704-57bf1f8a-5396-40bf-b730-dab3f683c89e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MDk3MTA2NjUsIm5iZiI6MTcwOTcxMDM2NSwicGF0aCI6Ii85MjAzNTQ4LzI5ODMwNzcwNC01N2JmMWY4YS01Mzk2LTQwYmYtYjczMC1kYWIzZjY4M2M4OWUucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDMwNiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDAzMDZUMDczMjQ1WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9OTUwNWY3YzUxMTNkYWQwYzg5ZDdkOTkyOWU5NmZhYmFmOGMwMWI2NzIyZmE4MTU0MDNmZTZmZDM0Y2Y1ZDliMyZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.PWjTd0uFkPQX_qlxixBKjMKZSKIjp4e5ESeu-9WnfLE)
If true - those requests are served by the original Go Playground.
If you consider this as a security issue - please address this issue on the official Go bug tracker.