The sqlpage folder can be read by HTTP client requests

[olivierauverlot]

With the browser, we can download the files in the sqlpage folder. For example, it's possible to read the sqlpage.json configuration file. It's a security problem. The sqlpage folder must be keep hidden.

It's possible to set rewrite rules on the proxy side to block the download. But, I think that it will be cool to filter url in sqlpage server.

[lovasoa]

Thank you very much for the report. The check was removed during a refactoring and we missed it because we didn't have a test for it. I'll release a new version today.

[lovasoa]

Just released v0.11.1

[lovasoa]

I published an advisory and requested a CVE, where you will be credited.

GHSA-v5wf-jg37-r9m5