Fix Improper Assets Management in Revel

Improper asset management in Revel isn't just about messy files; it's a direct path to Information Disclosure. Mapping the wrong directory to Static.Serve or leaving debug assets exposed in production allows attackers to sniff out .env files, source code, or internal configs. In the Revel framework, the Static controller is a common source of directory traversal or unintended exposure if the base path is set too high in the filesystem hierarchy.

The Vulnerable Pattern

// routes file
GET /static/*filepath    Static.Serve("/") 
GET /assets/*filepath    Static.Serve("app")

The Secure Implementation

The vulnerability occurs when Static.Serve is initialized with a root directory ('/') or a sensitive directory ('app'). This allows an attacker to request '/static/etc/passwd' or '/assets/conf/app.conf' via path traversal or direct mapping. To fix this, restrict Static.Serve to a dedicated, isolated directory like 'public/'. Additionally, ensure 'mode.dev' is disabled in production to prevent the exposure of internal framework assets and auto-generated documentation routes that Revel might otherwise inject.

// routes file
GET /public/*filepath    Static.Serve("public")
// In app.conf
[prod]
mode.dev = false
results.pretty = false
watch = false