Linux + hyper_server, access denide for ready other files(passwd; groups) [SECURITY]

[Skyp]

Hello everyone.

Please tell me how to prevent reading system files under hyper_server.

If I run the service without hyper_server, all handlers work:

Running under hyper_server successfully processes the request in the OnHttpCommand application handler (ServerModule)

However, when I run the service under hyper_server, the request doesn't even reach the service I'm developing:

--- 

It doesn't matter whether you run the service as root (sudoers) or as a regular user. All users have permission to read /etc/group; /etc/passwd (It linux). 

It is clear that the request does not even reach the application (headers are not returned).

How can I solve this problem?

 

 

 

 

 

[Farshad Mohajeri]

Hello,

Which version are you using.

We have fixed this issue in UNG-3576 .

[Farshad Mohajeri]

uniGUI file handler doesn't allow accessing paths on upper levels.

 // UNG-3576
  ADoc := UniStringReplace(ADoc, '../', '');
  ADoc := UniStringReplace(ADoc, '..\', '');
  ADoc := UniStringReplace(ADoc, #0, '');
  // UNG-3576

 

[Skyp]

Thx. 

I'm just updating time... and so problem .

Please view: 

 

[Skyp]

On 3/5/2026 at 5:31 PM, Farshad Mohajeri said:

uniGUI file handler doesn't allow accessing paths on upper levels.

 // UNG-3576
  ADoc := UniStringReplace(ADoc, '../', '');
  ADoc := UniStringReplace(ADoc, '..\', '');
  ADoc := UniStringReplace(ADoc, #0, '');
  // UNG-3576

 

Thx. 

I'm just updating... And that's problematic.

 

 

[Farshad Mohajeri]

Our build system uses library files from Ubuntu 24 which uses a newer GLIBC than yours. To solve this we need to downgrade to Ubuntu 20.