serve: bind to loopback by default - #3
Merged
Merged
Conversation
The banner said http://127.0.0.1 but neither backend was told to bind there: python -m http.server and npx http-server both listen on every interface by default, so the directory was reachable from the whole LAN. Pass --bind / -a explicitly, default to 127.0.0.1, and add -Bind for the case where sharing on the network is intended. The banner now prints the real address.
The install notes told people to add powershell.exe and pwsh.exe to the CFA allow-list for good. That hands every PowerShell script, ransomware included, write access to the protected folders, which is the one thing CFA is there to stop. The hard-coded pwsh path is also wrong for the Store build, whose path changes with every update. Allow the running host for the install only and remove it afterwards. Describe the actual symptom (a misleading "Could not find file" plus Defender event 1123), and drop the advice to move the clone: it is the write to Documents that is blocked, not the read from the clone.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
serveprintedhttp://127.0.0.1but startedpython -m http.server/npx http-serverwithout a bind address, and both listen on every interface by default. On a shared network the served directory was reachable by everyone.--bind/-aexplicitly, default127.0.0.1-Bindparameter for when sharing on the LAN is intendedTested on Windows 11 / PowerShell 7.6: the listener is on 127.0.0.1 only and answers there.