Disable Directory Listings

internal/handlers/handlers.go

@@ -209,7 +209,32 @@ func (h *Handler) RawFile(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) ServeStatic(w http.ResponseWriter, r *http.Request) {
-	http.StripPrefix("/static/", http.FileServer(h.staticFS)).ServeHTTP(w, r)
+	// Serve static files with directory listing completely disabled
+	filePath := strings.TrimPrefix(r.URL.Path, "/static/")
+	if filePath == "" || strings.HasSuffix(filePath, "/") || strings.Contains(filePath, "..") {
+		http.NotFound(w, r)
+		return
+	}
+
+	f, err := h.staticFS.Open(filePath)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	defer f.Close()
+
+	stat, err := f.Stat()
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	if stat.IsDir() {
+		http.NotFound(w, r)
+		return
+	}
+
+	http.ServeContent(w, r, stat.Name(), stat.ModTime(), f)
 }
 
 func (h *Handler) openISO(relPath string) (*iso.Reader, error) {

test_secure/test.txt

@@ -0,0 +1 @@
+Test