It seems that various JSON configuration files are easily viewable by requesting them with a simple GET request. Some examples of these are:
Some various files I've observed:
There could be useful to an attacker trying to monitor the patch version of Matomo sites, so the access settings should be made less permissive so that JSON files aren't as open to the web.
A useful command to enumerate over these from the core project is
find ./ -iname '*.json' | egrep -v '(vendor|lang|node_modules)'
FYI noticed originally
json was added to fix some tests in https://github.com/matomo-org/matomo/commit/903b870466b62e8a655a0f6564d052583c0fb7ec#diff-dddd74c8019f3e240dad1e60bc6ffbdd906ad7fa396b3e272a493f5b4af0c5c7
I suppose we could check through all the tests and see if we can maybe remove
package-lock.json we'll soon actually remove from the release directly but then they might still exist when someone uses submodules (which we do in some places so far). Possibly could otherwise also just specifically disallow some json files like