add an option for directory listing, default disabled

fs.go

@@ -28,6 +28,9 @@ var defaults = FileServerOptions{
 
 // FileServerOptions specifies options for FileServer.
 type FileServerOptions struct {
+	// DirListing controls whether a directory listing is shown for directories.
+	DirListing bool
+
 	// IndexHTML controls special handling of "index.html" file.
 	IndexHTML bool
 
@@ -143,6 +146,10 @@ func (fs *fileServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		if checkLastModified(w, req, fi.ModTime()) {
 			return
 		}
+		if !fs.opt.DirListing {
+			http.Error(w, "403 Forbidden", http.StatusForbidden)
+			return
+		}
 		err := dirList(w, f, path == "/")
 		if err != nil {
 			fs.opt.ServeError(w, req, err)

fs_test.go

@@ -51,6 +51,30 @@ func TestServeContent_detectContentType(t *testing.T) {
 	}
 }
 
+// Test that no dir listing is shown if the DirListing option is false.
+func TestFileServer_noDirListing(t *testing.T) {
+	fs := httpfs.New(mapfs.New(map[string]string{
+		"foo.txt": "Hello world",
+	}))
+	ts := httptest.NewServer(http.StripPrefix("/bar/", httpgzip.FileServer(fs, httpgzip.FileServerOptions{})))
+	defer ts.Close()
+	res, err := http.Get(ts.URL + "/bar/")
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	defer res.Body.Close()
+	if want := http.StatusForbidden; res.StatusCode != want {
+		t.Fatalf("got status %d, want %d", res.StatusCode, want)
+	}
+	b, err := ioutil.ReadAll(res.Body)
+	if err != nil {
+		t.Fatalf("ReadAll: %v", err)
+	}
+	if want := "403 Forbidden\n"; string(b) != want {
+		t.Fatalf("got body %q, want %q", b, want)
+	}
+}
+
 // Test that there are no infinite redirects at root path even if the entire
 // req.URL.Path is stripped, e.g., via an overly aggressive http.StripPrefix.
 // See https://github.com/shurcooL/httpgzip/pull/3
@@ -59,7 +83,7 @@ func TestFileServer_implicitLeadingSlash(t *testing.T) {
 	fs := httpfs.New(mapfs.New(map[string]string{
 		"foo.txt": "Hello world",
 	}))
-	ts := httptest.NewServer(http.StripPrefix("/bar/", httpgzip.FileServer(fs, httpgzip.FileServerOptions{})))
+	ts := httptest.NewServer(http.StripPrefix("/bar/", httpgzip.FileServer(fs, httpgzip.FileServerOptions{DirListing: true})))
 	defer ts.Close()
 	get := func(suffix string) string {
 		res, err := http.Get(ts.URL + suffix)