[dev.link] all: merge branch 'master' into dev.link

Clean merge.

Change-Id: I2ae0e4cc67e24216c85619717657dce36e887a54

1 files changed, 7 insertions, 5 deletions

diff --git a/src/net/http/fs.go b/src/net/http/fs.go
index f95f2426b7..07d15b07e9 100644
--- a/src/net/http/fs.go
+++ b/src/net/http/fs.go
@@ -30,11 +30,13 @@ import (
 // value is a filename on the native file system, not a URL, so it is separated
 // by filepath.Separator, which isn't necessarily '/'.
 //
-// Note that Dir will allow access to files and directories starting with a
-// period, which could expose sensitive directories like a .git directory or
-// sensitive files like .htpasswd. To exclude files with a leading period,
-// remove the files/directories from the server or create a custom FileSystem
-// implementation.
+// Note that Dir could expose sensitive files and directories. Dir will follow
+// symlinks pointing out of the directory tree, which can be especially dangerous
+// if serving from a directory in which users are able to create arbitrary symlinks.
+// Dir will also allow access to files and directories starting with a period,
+// which could expose sensitive directories like .git or sensitive files like
+// .htpasswd. To exclude files with a leading period, remove the files/directories
+// from the server or create a custom FileSystem implementation.
 //
 // An empty Dir is treated as ".".
 type Dir string