Skip to content

Commit

Permalink
Scope to working directory correctly (#316)
Browse files Browse the repository at this point in the history 
* Scope to working directory correctly

* Make it a little faster
  • Loading branch information
@leo
leo committed Jan 23, 2018
1 parent ce95709 commit 6adad68
Show file tree
Hide file tree
Showing 5 changed files with 47 additions and 38 deletions.
8 changes: 3 additions & 5 deletions bin/serve.js
View file
Expand Up @@ -51,11 +51,9 @@ if (flags.silent) {
console.log = () => {}
}

process.env.ASSET_DIR =
'/' +
Math.random()
.toString(36)
.substr(2, 10)
process.env.ASSET_DIR = Math.random()
.toString(36)
.substr(2, 10)

let current = process.cwd()

Expand Down
20 changes: 15 additions & 5 deletions lib/server.js
View file
Expand Up @@ -11,6 +11,7 @@ const pathType = require('path-type')
const mime = require('mime-types')
const stream = require('send')
const { coroutine } = require('bluebird')
const isPathInside = require('path-is-inside')

// Utilities
const renderDirectory = require('./render')
Expand Down Expand Up @@ -57,18 +58,27 @@ module.exports = coroutine(function*(req, res, flags, current, ignoredFiles) {
}

const { pathname } = parse(req.url)
const assetDir = path.normalize(process.env.ASSET_DIR)
const { ASSET_DIR } = process.env

let related = path.parse(path.join(current, pathname))
let assetRequest = false

if (related.dir.indexOf(assetDir) > -1) {
if (path.basename(related.dir) === ASSET_DIR) {
assetRequest = true
const relative = path.relative(assetDir, pathname)
related = path.parse(path.join(__dirname, '/../assets', relative))
related = decodeURIComponent(path.join(__dirname, '/../assets/styles.css'))
} else {
related = decodeURIComponent(path.format(related))

const relatedResolved = path.resolve(related)
const relatedCurrent = path.resolve(current)

const isSame = relatedResolved === relatedCurrent

if (!isSame && !isPathInside(relatedResolved, relatedCurrent)) {
return micro.send(res, 400, 'Bad Request')
}
}

related = decodeURIComponent(path.format(related))
let notFoundResponse = 'Not Found'

try {
Expand Down
1 change: 1 addition & 0 deletions package.json
View file
Expand Up @@ -68,6 +68,7 @@
"node-version": "1.1.0",
"openssl-self-signed-certificate": "1.1.6",
"opn": "5.1.0",
"path-is-inside": "1.0.2",
"path-type": "3.0.0",
"send": "0.16.1"
}
Expand Down
2 changes: 1 addition & 1 deletion views/index.hbs
View file
Expand Up @@ -6,7 +6,7 @@

<title>Files within {{directory}}</title>

<link rel="stylesheet" href="{{assetDir}}/styles.css">
<link rel="stylesheet" href="/{{assetDir}}/styles.css">
</head>

<body>
Expand Down
54 changes: 27 additions & 27 deletions yarn.lock
View file
Expand Up @@ -265,8 +265,8 @@ asynckit@^0.4.0:
resolved "https://registry.yarnpkg.com/asynckit/-/asynckit-0.4.0.tgz#c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79"

auto-bind@^1.1.0:
version "1.1.0"
resolved "https://registry.yarnpkg.com/auto-bind/-/auto-bind-1.1.0.tgz#93b864dc7ee01a326281775d5c75ca0a751e5961"
version "1.2.0"
resolved "https://registry.yarnpkg.com/auto-bind/-/auto-bind-1.2.0.tgz#8b7e318aad53d43ba8a8ecaf0066d85d5f798cd6"

ava-init@^0.2.0:
version "0.2.1"
Expand Down Expand Up @@ -506,8 +506,8 @@ babel-plugin-check-es2015-constants@^6.8.0:
babel-runtime "^6.22.0"

babel-plugin-espower@^2.3.2:
version "2.3.2"
resolved "https://registry.yarnpkg.com/babel-plugin-espower/-/babel-plugin-espower-2.3.2.tgz#5516b8fcdb26c9f0e1d8160749f6e4c65e71271e"
version "2.4.0"
resolved "https://registry.yarnpkg.com/babel-plugin-espower/-/babel-plugin-espower-2.4.0.tgz#9f92c080e9adfe73f69baed7ab3e24f649009373"
dependencies:
babel-generator "^6.1.0"
babylon "^6.1.0"
Expand Down Expand Up @@ -949,8 +949,8 @@ co@^4.6.0:
resolved "https://registry.yarnpkg.com/co/-/co-4.6.0.tgz#6ea6bdf3d853ae54ccb8e47bfa0bf3f9031fb184"

code-excerpt@^2.1.0:
version "2.1.0"
resolved "https://registry.yarnpkg.com/code-excerpt/-/code-excerpt-2.1.0.tgz#5dcc081e88f4a7e3b554e9e35d7ef232d47f8147"
version "2.1.1"
resolved "https://registry.yarnpkg.com/code-excerpt/-/code-excerpt-2.1.1.tgz#5fe3057bfbb71a5f300f659ef2cc0a47651ba77c"
dependencies:
convert-to-spaces "^1.0.1"

Expand Down Expand Up @@ -1306,8 +1306,8 @@ empower-core@^0.6.1:
core-js "^2.0.0"

encodeurl@~1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-1.0.1.tgz#79e3d58655346909fe6f0f45a5de68103b294d20"
version "1.0.2"
resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-1.0.2.tgz#ad3ff4c86ec2d029322f5a02c3a9a606c95b3f59"

enhance-visitors@^1.0.0:
version "1.0.0"
Expand All @@ -1326,17 +1326,17 @@ error-ex@^1.2.0, error-ex@^1.3.1:
is-arrayish "^0.2.1"

es5-ext@^0.10.14, es5-ext@^0.10.35, es5-ext@^0.10.9, es5-ext@~0.10.14:
version "0.10.37"
resolved "https://registry.yarnpkg.com/es5-ext/-/es5-ext-0.10.37.tgz#0ee741d148b80069ba27d020393756af257defc3"
version "0.10.38"
resolved "https://registry.yarnpkg.com/es5-ext/-/es5-ext-0.10.38.tgz#fa7d40d65bbc9bb8a67e1d3f9cc656a00530eed3"
dependencies:
es6-iterator "~2.0.1"
es6-iterator "~2.0.3"
es6-symbol "~3.1.1"

es6-error@^4.0.1, es6-error@^4.0.2:
version "4.1.1"
resolved "https://registry.yarnpkg.com/es6-error/-/es6-error-4.1.1.tgz#9e3af407459deed47e9a91f9b885a84eb05c561d"

es6-iterator@^2.0.1, es6-iterator@~2.0.1:
es6-iterator@^2.0.1, es6-iterator@~2.0.1, es6-iterator@~2.0.3:
version "2.0.3"
resolved "https://registry.yarnpkg.com/es6-iterator/-/es6-iterator-2.0.3.tgz#a7de889141a05a94b0854403b2d0a0fbfa98f3b7"
dependencies:
Expand Down Expand Up @@ -1433,8 +1433,8 @@ eslint-module-utils@^2.1.1:
pkg-dir "^1.0.0"

eslint-plugin-ava@^4.2.0:
version "4.4.0"
resolved "https://registry.yarnpkg.com/eslint-plugin-ava/-/eslint-plugin-ava-4.4.0.tgz#c1866e1f62e70daf2b7b5f60cfbc53bfe267a717"
version "4.5.0"
resolved "https://registry.yarnpkg.com/eslint-plugin-ava/-/eslint-plugin-ava-4.5.0.tgz#9f305d0703e2879974fa9ead29cc533b3d12a44b"
dependencies:
arrify "^1.0.1"
deep-strict-equal "^0.2.0"
Expand Down Expand Up @@ -2384,8 +2384,8 @@ is-regexp@^1.0.0:
resolved "https://registry.yarnpkg.com/is-regexp/-/is-regexp-1.0.0.tgz#fd2d883545c46bac5a633e7b9a09e87fa2cb5069"

is-resolvable@^1.0.0:
version "1.0.1"
resolved "https://registry.yarnpkg.com/is-resolvable/-/is-resolvable-1.0.1.tgz#acca1cd36dbe44b974b924321555a70ba03b1cf4"
version "1.1.0"
resolved "https://registry.yarnpkg.com/is-resolvable/-/is-resolvable-1.1.0.tgz#fb18f87ce1feb925169c9a407c19318a3206ed88"

is-retry-allowed@^1.0.0:
version "1.1.0"
Expand Down Expand Up @@ -2781,8 +2781,8 @@ log-symbols@^1.0.2:
chalk "^1.0.0"

log-symbols@^2.0.0:
version "2.1.0"
resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-2.1.0.tgz#f35fa60e278832b538dc4dddcbb478a45d3e3be6"
version "2.2.0"
resolved "https://registry.yarnpkg.com/log-symbols/-/log-symbols-2.2.0.tgz#5740e1c5d6f0dfda4ad9323b5332107ef6b4c40a"
dependencies:
chalk "^2.0.1"

Expand Down Expand Up @@ -3321,7 +3321,7 @@ path-is-absolute@^1.0.0, path-is-absolute@^1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/path-is-absolute/-/path-is-absolute-1.0.1.tgz#174b9268735534ffbc7ace6bf53a5a9e1b5c5f5f"

path-is-inside@^1.0.1, path-is-inside@^1.0.2:
path-is-inside@1.0.2, path-is-inside@^1.0.1, path-is-inside@^1.0.2:
version "1.0.2"
resolved "https://registry.yarnpkg.com/path-is-inside/-/path-is-inside-1.0.2.tgz#365417dede44430d1c11af61027facf074bdfc53"

Expand Down Expand Up @@ -3509,8 +3509,8 @@ raw-body@2.3.2:
unpipe "1.0.0"

rc@^1.0.1, rc@^1.1.6, rc@^1.1.7:
version "1.2.3"
resolved "https://registry.yarnpkg.com/rc/-/rc-1.2.3.tgz#51575a900f8dd68381c710b4712c2154c3e2035b"
version "1.2.4"
resolved "https://registry.yarnpkg.com/rc/-/rc-1.2.4.tgz#a0f606caae2a3b862bbd0ef85482c0125b315fa3"
dependencies:
deep-extend "~0.4.0"
ini "~1.3.0"
Expand Down Expand Up @@ -3791,8 +3791,8 @@ semver-diff@^2.0.0:
semver "^5.0.3"

"semver@2 || 3 || 4 || 5", semver@^5.0.3, semver@^5.1.0, semver@^5.3.0, semver@^5.4.1:
version "5.4.1"
resolved "https://registry.yarnpkg.com/semver/-/semver-5.4.1.tgz#e059c09d8571f0540823733433505d3a2f00b18e"
version "5.5.0"
resolved "https://registry.yarnpkg.com/semver/-/semver-5.5.0.tgz#dc4bbc7a6ca9d916dee5d43516f0092b58f7b8ab"

send@0.16.1:
version "0.16.1"
Expand Down Expand Up @@ -3889,8 +3889,8 @@ source-map-support@^0.4.15:
source-map "^0.5.6"

source-map-support@^0.5.0:
version "0.5.0"
resolved "https://registry.yarnpkg.com/source-map-support/-/source-map-support-0.5.0.tgz#2018a7ad2bdf8faf2691e5fddab26bed5a2bacab"
version "0.5.2"
resolved "https://registry.yarnpkg.com/source-map-support/-/source-map-support-0.5.2.tgz#1a6297fd5b2e762b39688c7fc91233b60984f0a5"
dependencies:
source-map "^0.6.0"

Expand Down Expand Up @@ -4300,8 +4300,8 @@ util-deprecate@~1.0.1:
resolved "https://registry.yarnpkg.com/util-deprecate/-/util-deprecate-1.0.2.tgz#450d4dc9fa70de732762fbd2d4a28981419a0ccf"

uuid@^3.0.0:
version "3.1.0"
resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.1.0.tgz#3dd3d3e790abc24d7b0d3a034ffababe28ebbc04"
version "3.2.1"
resolved "https://registry.yarnpkg.com/uuid/-/uuid-3.2.1.tgz#12c528bb9d58d0b9265d9a2f6f0fe8be17ff1f14"

validate-npm-package-license@^3.0.1:
version "3.0.1"
Expand Down

0 comments on commit 6adad68

Please sign in to comment.