I've got a rewrite rule set up like this:
RewriteCond %{DOCUMENT_ROOT}/cache/%{REQUEST_URI} -f
RewriteRule ^(.*)$ cache/$1 [QSA,PT,L]
Brief explanation for this rule: it checks to see if a requested file exists in the cache directory. If it does, then it serves the cache directory.
E.g. a request to http://somehost.tld/about.html would be served from http://somehost.tld/cache/about.html (if this file exists).
What I'm concerned about is if the RewriteRule is insecure. Is it possible for someone to request a URL like this, with double periods in it to move up a directory:
http://somehost.tld/../../private_file.txt
So causing private_file.txt to be served from a directory above my apache public folder?
private_file.txt
. However a determined attacker could possibly test for the presence ofprivate_file.txt
on your system by the response given.