node-http-server – Blame information for rev 18
?pathlinks?
Rev | Author | Line No. | Line |
---|---|---|---|
8 | office | 1 | #!/usr/bin/env node |
2 | |||
9 | office | 3 | /*************************************************************************/ |
4 | /* Copyright (C) 2017 Wizardry and Steamworks - License: GNU GPLv3 */ |
||
5 | /*************************************************************************/ |
||
6 | |||
8 | office | 7 | const url = require('url'); |
8 | const path = require('path'); |
||
9 | const fs = require('fs'); |
||
10 | const mime = require('mime'); |
||
14 | office | 11 | const auth = require("http-auth"); |
8 | office | 12 | |
14 | office | 13 | // Checks whether userPath is a child of rootPath. |
15 | office | 14 | function isRooted(userPath, rootPath, separator, callback) { |
15 | process.nextTick(() => { |
||
16 | userPath = userPath.split(separator).filter(Boolean); |
||
17 | rootPath = rootPath.split(separator).filter(Boolean); |
||
18 | callback(userPath.length >= rootPath.length && |
||
19 | rootPath.every((e, i) => e === userPath[i])); |
||
20 | }); |
||
8 | office | 21 | } |
22 | |||
14 | office | 23 | // Serves files. |
17 | office | 24 | function files(config, request, response, requestPath, callback) { |
14 | office | 25 | // Check if the file is accessible. |
17 | office | 26 | fs.access(requestPath, fs.constants.R_OK, (error) => { |
15 | office | 27 | if (error) { |
28 | response.statusCode = 403; |
||
29 | response.end(); |
||
30 | return; |
||
31 | } |
||
32 | |||
33 | response.setHeader( |
||
34 | 'Content-Type', |
||
17 | office | 35 | mime.lookup(requestPath) |
15 | office | 36 | ); |
37 | |||
17 | office | 38 | var readStream = fs.createReadStream(requestPath) |
15 | office | 39 | .on('open', () => { |
40 | response.statusCode = 200; |
||
41 | readStream.pipe(response); |
||
42 | }) |
||
43 | .on('error', () => { |
||
44 | response.statusCode = 500; |
||
45 | response.end(); |
||
46 | }); |
||
47 | |||
48 | }); |
||
49 | } |
||
50 | |||
51 | // Serves a directory listing or the document index in case it exists. |
||
17 | office | 52 | function index(config, request, response, requestPath, requestURL, callback) { |
53 | const root = path.resolve(requestPath, config.site.index); |
||
15 | office | 54 | fs.stat(root, (error, stats) => { |
17 | office | 55 | if (error) { |
56 | if(config.site.indexing |
||
57 | .some((directory) => |
||
58 | directory.toUpperCase() === requestURL.toUpperCase())) { |
||
59 | fs.readdir(requestPath, (error, paths) => { |
||
60 | if (error) { |
||
61 | process.nextTick(() => { |
||
62 | callback('Could not list directory: ' + |
||
63 | requestPath, |
||
64 | module.exports.error.level.ERROR |
||
65 | ); |
||
66 | }); |
||
67 | response.statusCode = 500; |
||
68 | response.end(); |
||
69 | return; |
||
70 | } |
||
15 | office | 71 | process.nextTick(() => { |
17 | office | 72 | callback('Directory listing requested for: ' + |
73 | requestPath, |
||
74 | module.exports.error.level.INFO |
||
15 | office | 75 | ); |
76 | }); |
||
17 | office | 77 | response.statusCode = 200; |
78 | response.write(JSON.stringify(paths)); |
||
15 | office | 79 | response.end(); |
80 | }); |
||
81 | |||
17 | office | 82 | return; |
83 | } |
||
84 | |||
18 | office | 85 | // Could not access directory index file and directory listing not allowed. |
86 | response.statusCode = 404; |
||
87 | response.end(); |
||
88 | return; |
||
89 | |||
15 | office | 90 | } |
91 | |||
92 | // Serve the document index. |
||
17 | office | 93 | fs.access(requestPath, fs.constants.R_OK, (error) => { |
14 | office | 94 | if (error) { |
15 | office | 95 | process.nextTick(() => { |
96 | callback('The server was unable to access the filesystem path: ' + |
||
17 | office | 97 | requestPath, |
15 | office | 98 | module.exports.error.level.WARN |
99 | ); |
||
100 | }); |
||
14 | office | 101 | response.statusCode = 403; |
102 | response.end(); |
||
103 | return; |
||
104 | } |
||
105 | |||
15 | office | 106 | // Set MIME content type. |
14 | office | 107 | response.setHeader( |
108 | 'Content-Type', |
||
15 | office | 109 | mime.lookup(root) |
14 | office | 110 | ); |
111 | |||
15 | office | 112 | var readStream = fs.createReadStream(root) |
14 | office | 113 | .on('open', () => { |
114 | response.statusCode = 200; |
||
115 | readStream.pipe(response); |
||
116 | }) |
||
117 | .on('error', () => { |
||
118 | response.statusCode = 500; |
||
119 | response.end(); |
||
120 | }); |
||
121 | |||
122 | }); |
||
123 | }); |
||
124 | } |
||
125 | |||
17 | office | 126 | // Determines whether the requested filesystem request path is a directory or a file. |
127 | function serve(config, request, response, requestPath, requestURL, callback) { |
||
128 | fs.stat(requestPath, (error, stats) => { |
||
15 | office | 129 | // Document does not exist. |
130 | if (error) { |
||
131 | response.statusCode = 404; |
||
132 | response.end(); |
||
133 | return; |
||
134 | } |
||
14 | office | 135 | |
15 | office | 136 | switch (stats.isDirectory()) { |
137 | case true: // Directory is requested so provide directory indexes. |
||
17 | office | 138 | index(config, request, response, requestPath, requestURL, callback); |
15 | office | 139 | break; |
140 | default: // Browser requesting file. |
||
17 | office | 141 | files(config, request, response, requestPath, callback); |
15 | office | 142 | break; |
143 | } |
||
14 | office | 144 | }); |
145 | } |
||
146 | |||
8 | office | 147 | module.exports = { |
148 | error: { |
||
149 | level: { |
||
150 | INFO: 1, |
||
151 | WARN: 2, |
||
152 | ERROR: 3 |
||
153 | } |
||
154 | }, |
||
11 | office | 155 | process: (config, request, response, root, callback) => { |
8 | office | 156 | process.nextTick(() => { |
14 | office | 157 | // Create digest authentication. |
158 | const authentication = auth.digest({ |
||
159 | realm: config.auth.realm, |
||
160 | file: path.resolve( |
||
161 | path.dirname(require.main.filename), |
||
162 | config.auth.digest |
||
163 | ) |
||
164 | }); |
||
165 | |||
8 | office | 166 | const requestAddress = request.socket.address(); |
17 | office | 167 | const requestURL = url.parse( |
14 | office | 168 | request.url, true |
169 | ); |
||
8 | office | 170 | |
17 | office | 171 | const trimmedPath = requestURL |
8 | office | 172 | .pathname |
173 | .split('/') |
||
174 | .filter(Boolean) |
||
175 | .join('/'); |
||
17 | office | 176 | const requestPath = trimmedPath === '/' ? |
8 | office | 177 | path.join(root, trimmedPath) : |
178 | path.resolve(root, trimmedPath); |
||
179 | |||
17 | office | 180 | isRooted(requestPath, root, path.sep, (rooted) => { |
15 | office | 181 | if (!rooted) { |
182 | process.nextTick(() => { |
||
183 | callback('Attempted path traversal: ' + |
||
184 | requestAddress.address + ':' + |
||
185 | requestAddress.port + |
||
186 | ' requesting: ' + |
||
17 | office | 187 | requestURL.pathname, |
15 | office | 188 | module.exports.error.level.WARN |
189 | ); |
||
190 | }); |
||
191 | response.statusCode = 404; |
||
192 | response.end(); |
||
193 | return; |
||
194 | } |
||
8 | office | 195 | |
15 | office | 196 | // Check if the requested path requires authentication. |
197 | switch (config.auth.locations.some( |
||
17 | office | 198 | (authPath) => authPath.toUpperCase() === requestURL.pathname.toUpperCase())) { |
15 | office | 199 | case true: |
200 | // Requested location requires authentication. |
||
201 | authentication.check(request, response, (request, response) => { |
||
202 | process.nextTick(() => { |
||
203 | callback('Authenticated client: ' + |
||
204 | requestAddress.address + ':' + |
||
205 | requestAddress.port + |
||
206 | ' accessing: ' + |
||
17 | office | 207 | requestURL.pathname, |
15 | office | 208 | module.exports.error.level.INFO |
209 | ); |
||
210 | }); |
||
17 | office | 211 | serve(config, |
212 | request, |
||
213 | response, |
||
214 | requestPath, |
||
215 | requestURL.pathname, |
||
216 | callback |
||
217 | ); |
||
15 | office | 218 | }); |
219 | break; |
||
220 | default: |
||
14 | office | 221 | process.nextTick(() => { |
15 | office | 222 | callback('Client: ' + |
14 | office | 223 | requestAddress.address + ':' + |
224 | requestAddress.port + |
||
225 | ' accessing: ' + |
||
17 | office | 226 | requestURL.pathname, |
14 | office | 227 | module.exports.error.level.INFO |
228 | ); |
||
8 | office | 229 | }); |
17 | office | 230 | serve(config, |
231 | request, |
||
232 | response, |
||
233 | requestPath, |
||
234 | requestURL.pathname, |
||
235 | callback |
||
236 | ); |
||
15 | office | 237 | break; |
238 | } |
||
239 | }); |
||
8 | office | 240 | }); |
241 | } |
||
242 | }; |