From 566e710991a6b752933178e2c6126181efc563aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oleh=20Konko=20=7C=20semantic=20verification=20for=20trust?= =?UTF-8?q?=20infra=20=7C=20=20LLM-augmented=20operations=20pipeline=20=28?= =?UTF-8?q?precision-first=2C=20claim=E2=89=A4evidence=2C=20submit-human?= =?UTF-8?q?=29=20=7C=20verify=20the=20payload=2C=20not=20the=20signer?= Date: Wed, 4 Mar 2026 23:00:10 +0100 Subject: [PATCH] fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548) --- modules/caddyhttp/fileserver/staticfiles.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/caddyhttp/fileserver/staticfiles.go b/modules/caddyhttp/fileserver/staticfiles.go index 8a074f546..dce40302d 100644 --- a/modules/caddyhttp/fileserver/staticfiles.go +++ b/modules/caddyhttp/fileserver/staticfiles.go @@ -125,6 +125,11 @@ type FileServer struct { // When possible, all paths are resolved to their absolute form before // comparisons are made. For maximum clarity and explictness, use complete, // absolute paths; or, for greater portability, use relative paths instead. + // + // Note that hide comparisons are case-sensitive. On case-insensitive + // filesystems, requests with different path casing may still resolve to the + // same file or directory on disk, so hide should not be treated as a + // security boundary for sensitive paths. Hide []string `json:"hide,omitempty"` // The names of files to try as index files if a folder is requested.