restrictions

[aspnet-hello]

From @dazinator on Thursday, November 24, 2016 5:34:06 PM

Its interesting to read #232 #213 #186 where basically the comments from the team seem to indicate an intention to bake in security restrictions (such as ignoring files that start with ".") to make particular files invisible.

Seems backwards to me. It seems these decisions may be taken purely because one use case for a provider is to automatically serve up content from a webroot directory to the browser.

However this is not the sole use case. The environment also has a content root file provider. Also the fileprovider does not appear to be tied to asp.net web app necessarily, and could be used from console apps. When a developer wants to read a file, how do you know their use case isn't to read a file that is hidden or starts with a dot?

It seems to me that the consequences of setting a physical file provider to serve a webroot folder should be understood by develoers i e every file in that folder is serveable.

If it's not desirable to serve certain files wouldn't middleware be the best place to stop that - not the file provider itself?

Just thought I'd chime in with my opinion - because after all, this is github :-)

Copied from original issue: aspnet/FileSystem#247

[dazinator]

fyi This issue has been transferred and now the linked issues in its description don't tie up to their original location

[aspnet-hello]

Thanks for your feedback. We appreciate your letting us know about the problem you've encountered or suggestion but we are not planning to take further action on this issue because our focus has been on issues with significantly higher customer interest and issues impacting a broad number of customers.