58

We have a rails application in subversion that we deploy with Capistrano but have noticed that we can access the files in '/.svn', which presents a security concern.

I wanted to know what the best way to do this. A few ideas:

  • Global Apache configuration to deny access
  • Adding .htaccess files in the public folder and all subfolders
  • Cap task that changes the permissions

I don't really like the idea of deleting the folders or using svn export, since I would like to keep the 'svn info' around.

1
  • 2
    By the way, you don't need to put .htaccess files in subfolders, the rules automatically apply to all subdirectories.
    – Vinko Vrsalovic
    Dec 29, 2008 at 16:46

13 Answers 13

64

The best option is to use Apache configuration.

Using htaccess or global configuration depends mainly on if you control your server.

If you do, you can use something like

<DirectoryMatch .*\.svn/.*>
    Deny From All
</DirectoryMatch>

If you don't, you can do something similar in .htaccess files with FilesMatch

4
  • 1
    I could not get this to work with .htaccess and FilesMatch. I could get it to block a request to site.com/.svn, but I could still access files if I directly requested them. For now I am using the RedirectMatch as suggested below. The other option is a RewriteRule.
    – Tao Zhyn
    Feb 12, 2009 at 23:09
  • 16
    I used this approach combined with Riccardo Galli's list of multiple cvs systems to great effect: <DirectoryMatch .*\.(svn|git|hg|bzr|cvs)/.*> Deny From All </DirectoryMatch> This matches all subdirectories / files also. It reveals only if the top level directory exists (otherwise it would return a 404) but .svn/doesnotexist returns a 403.
    – chmac
    Jul 31, 2012 at 13:17
  • Not all servers are configured to overwrite this httpd.conf settings from .htaccess. If works; you are lucky. Aug 10, 2014 at 9:10
  • For Apache 2.4+: <DirectoryMatch "/\.svn"> Require all denied </DirectoryMatch>
    – ColinM
    May 27, 2016 at 2:35
44

One other way to protect the .svn files would be to use a redirect in the Apache config:

RedirectMatch 404 /\\.svn(/|$)

So instead of getting a 403 forbidden (and providing clues to would be attackers) you get a 404, which is what we would expect when randomly typing in paths.

2
  • Yes, this is non HTTP-compliant though :)
    – Vinko Vrsalovic
    Dec 29, 2008 at 18:17
  • 4
    Why is this not HTTP-compliant? By the way, it worked great for me, thanks!
    – Yes Barry
    Apr 2, 2012 at 3:36
30

I do not like the idea of 404ing each file startig wit a dot. I'd use a more selective approach, either with the cvs I'm using in the project (svn in the example)

RedirectMatch 404 /\\.svn(/|$)

or a catch all cvs systems

RedirectMatch 404 /\\.(svn|git|hg|bzr|cvs)(/|$)

-- outdated answer follows (see comments) --

I cant write comments yet so... The answer of csexton is incorrect, because an user cannot access the .svn folder, but can access any files inside it ! e.g. you can access http://myserver.com/.svn/entries

The correct rule is

RedirectMatch 404 /\\.svn(/.*|$)
5
  • The .* is not necessary, the answer of csexton is sufficient. csexton's regex matches "/.svn" at the end of the requested path or "/.svn/" anywhere in the requested path. So it will also work for requests to /path/to/.svn/entries. Sep 29, 2011 at 9:27
  • Did you try? I did and I had access to .svn/entries with csexton rule Sep 29, 2011 at 11:42
  • 1
    I'm using the rule RedirectMatch 404 /\.svn(/|$) on Apache 2.2 and get a 404 with /.svn/entries Sep 29, 2011 at 15:08
  • You're right. I wrote this answer because the behaviour was different at that time. It seems like today Apache use the regexp as partial if $ is missing (which makes sense). I'll update my answer. Thank you Sep 29, 2011 at 19:26
  • I suspected something like that, that's why I mentioned my Apache version number. The current behaviour makes more sense, that's right. Sep 29, 2011 at 19:39
14

I think Riccardo Galli got it right. Even apache already had .svn setup as forbidden for me, but .svn/entries was certainly available...exposing my svn server, port number, usernames, etc.

I actually figure, why not restrict .git as a preventative measure (say you don't use git yet but may someday at which time you will not be thinking about directory restrictions).

And then I thought, why not restrict everything that should be hidden anyway? Can anyone conceive of a problem with this?

RedirectMatch 404 /\\..*(/.*|$)

I added the '.*' after the initial period - only difference from Riccardo. Seems to 404 .svn, .git, .blah, etc.

3
  • This works well with .hg (Mercurial). It protects also the nested folders and files.
    – MZAweb
    May 11, 2011 at 19:59
  • 3
    Because you only have to check if a URL path contains a forward-slash followed by a dot, this should also work: RedirectMatch 404 /\.
    – Robert Ros
    Aug 17, 2011 at 10:09
  • The cleanest formally-correct regex would be: RedirectMatch 404 /\..*$ Aug 16, 2013 at 9:09
6

I would rather deny access to all dot-files (eg: .htaccess, .svn, .xxx, etc.), as they normally don't need to be web-accessible.

Here's the rule to achieve this (until Apache 2.2 included):

<LocationMatch "\/\..*">
    Order allow,deny
    Deny from all
</LocationMatch>

(UPDATE) Or you can use the following (which works in Apache 2.2 and 2.4):

# Deny access to dot-files, as 404 error
# (not giving hint about potential existence to the file)
RedirectMatch 404 ".*\/\..*"
1
  • 1
    @w00t just changed to propose a working solution on 2.4, thanks. Apr 11, 2016 at 15:29
3

RedirectMatch like other directives from mod_alias is case sensitive even on case-insensitive file systems (see mod_alias documentation). So the answers above about matching and blocking files of all version control systems are not correct.

Instead of

RedirectMatch 404 /\\.(svn|git|hg|bzr|cvs)(/|$)

or

RedirectMatch permanent .*\.(svn|git|hg|bzr|cvs)/.* /

something like this is necessary

RedirectMatch 404 "(?i)/\.?(cvs|svn|git|hg|bzr)"

to really block everything, because

  • CVS directories are uppercase; and
  • don't start with a dot (.) in front.

I hope that helps.

1

A RedirectMatch will respond with a 404, which is great.

However, if "Options +Indexes" is enabled, then users will still be able to see the '.svn' directory from the Parent directory.

Users won't be able to enter the directory-- this is where the '404 Not Found' comes in. However, they will be able to see the directory and provide clues to would be attackers.

1

I seems to me, Apache conf should be :

<Directory ~ "\.svn">
    Order allow,deny
    Deny from all
</Directory>
1

This:

RedirectMatch permanent .*\.(svn|git|hg|bzr|cvs)/.* /

can also be used if you don't want to send an error back to the user.

It's only redirecting back to the site rootpage. Also, this is a permanent redirect, so the robots won't try to reindex this URL.

1

I'm not all that fond of RedirectMatch, so I used a RewriteRule instead:

RewriteRule /\..*(/.*|$) - [R=404,L]

The hyphen means "don't do any substitution". I also could not figure out why, in the examples above, the regex had two backslashes:

/\\..*(/.*|$)

So I took one out and it works fine. I can't figure out why you would use two there. Someone care to enlighten me?

1
  • Thanks for this. I've found it can be even simpler, too: RewriteRule /\. - [R=403,L] works for me.
    – IpsRich
    Oct 12, 2015 at 8:00
1

Apache Subversion FAQ is sugesting this solution:

# Disallow browsing of Subversion working copy administrative dirs.
<DirectoryMatch "^/.*/\.svn/">
    Order deny,allow
    Deny from all
</DirectoryMatch>

source: https://subversion.apache.org/faq.html#website-auto-update

0

In .htaccess on your server config file.

(1)

RewriteEngine on
RewriteRule "^(.*/)?\.git/" - [F,L]

And (2)

RedirectMatch 404 /\.git

Place this both method in .htaccess file.

It hides any file or directory whose name begins with .git Like .git directory or .gitignore file by returning a 404.

-7

Create a access rights file in your subversion server installation.

e.g if you folder structure is

/svn

/svn/rights/svnauth.conf

create a configuration file and enter the path of that file in your apache subversion configuration file which you would normally find at /etc/httpd/conf.d/subversion.conf

In your svnauth.conf file define the rights as :

access rights for Foo.com

[foo.com:/trunk/source]

dev1=rw

dev2=rw .....

This way you can control the access rights from one single file and at much granular level.

For more information peruse through the svn red book.

1
  • 1
    You have misunderstood the question. He is talking about the .svn directory that gets created on checkout, not about developers permissions on the repository
    – Vinko Vrsalovic
    Dec 29, 2008 at 18:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.