StaticFile.fromUrl can leak presence of a directory

Impact StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a directory, without first checking the...

CVE-2021-32643

The CVE-2021-32643 issue affects http4s (Scala HTTP services) where StaticFile.fromUrl can reveal the existence of a server directory when the URL scheme is not file://. If url.getFile is a directory, a non-file URL could yield a 404 that leaks directory presence, without exposing contents or met...