Path traversal + unauth file write in dev server (--serve)

[Ikram-4]

Description: Two issues in marmite --serve dev server (default 0.0.0.0:8000, no auth). Static site/ deployments unaffected.

1. CWE-22 Arbitrary file read src/server.rs:187 decode(request.url()) src/server.rs:299-304 url_without_query / request_path = url[1..] — no .. validation src/server.rs:306 output_folder.join(&request_path) src/server.rs:309-310 is_file() / File::open()

2. CWE-306 + CWE-22 Unauthenticated arbitrary file write src/server.rs:455 handle_create_content -> src/content.rs:1070-1073 path.push(dir) / create_dir_all / File::create src/server.rs:652 handle_clone_content -> src/content.rs:1306 String::from(new_slug) unsanitized / src/content.rs:1315 parent.join(format!) / 1321 fs::copy src/server.rs:600 handle_move_content -> src/content.rs:1361-1380 only .md check / 1370 content_folder.join(new_filename) / 1379 parent.join / 1389 fs::rename src/server.rs:872-914,941-963 handle_file_api / 878 input_folder.join(rel_path) / 914,958 fs::write src/server.rs:1108-1139 handle_put_config_raw / 1131 fs::write(config) -> src/site.rs:2697-2710 handle_file_mappings / 2703 abs source allowed / 2709 output_folder.join(dest)

Version: 0.4.2

[rochacbruno]

Thanks for the report. Marmite's built-in server is intended for development and local authoring only, not production deployments. As noted in the report, deployed static sites are unaffected.

PR #555 makes two scoped changes:

• Default --serve to 127.0.0.1:8000, and preserve the requested interface when falling back to an OS-assigned port. Explicit binds such as --bind 0.0.0.0:8000 remain available.
• Clearly identify the server as development-only in CLI help, source comments, documentation, and terminal startup output.

The scope is intentionally limited to these changes to retain the existing development/editor workflow. The PR does not add authentication, CSRF/CORS validation, or filesystem restrictions, and it should not be interpreted as fixing the broader path-traversal findings.