@bitblit/ratchet-node-only 6.1.198-alpha → 6.1.199-alpha

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,4 @@
1
+ import { Agent } from "node:https";
2
+ export declare class LocalFileServerHttpsFetch {
3
+ static createLocalFileServerAgent(): Agent;
4
+ }
@@ -0,0 +1,10 @@
1
+ import https from "https";
2
+ import { LocalServerCert } from "./local-server-cert.js";
3
+ export class LocalFileServerHttpsFetch {
4
+ static createLocalFileServerAgent() {
5
+ return new https.Agent({
6
+ ca: LocalServerCert.CLIENT_KEY_PEM
7
+ });
8
+ }
9
+ }
10
+ //# sourceMappingURL=local-file-server-https-fetch.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"local-file-server-https-fetch.js","sourceRoot":"","sources":["../../src/http/local-file-server-https-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAOzD,MAAM,OAAO,yBAAyB;IAE7B,MAAM,CAAC,0BAA0B;QACtC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAE;YACtB,EAAE,EAAE,eAAe,CAAC,cAAc;SACnC,CAAC,CAAC;IACL,CAAC;CAEF"}
@@ -62,21 +62,45 @@ export class LocalFileServer {
62
62
  }
63
63
  async requestHandler(request, response) {
64
64
  const reqPath = request.url.includes('?') ? request.url.substring(0, request.url.indexOf('?')) : request.url;
65
- const filePath = path.join(this.fileRoot, reqPath);
66
- if (fs.existsSync(filePath)) {
67
- const stats = fs.statSync(filePath);
65
+ const rootReal = fs.realpathSync(this.fileRoot);
66
+ const pathname = new URL(request.url ?? '/', this.urlRoot).pathname;
67
+ const decoded = decodeURIComponent(pathname);
68
+ if (decoded.includes('\0')) {
69
+ response.statusCode = 400;
70
+ response.end('Bad path');
71
+ return;
72
+ }
73
+ const relative = decoded.replace(/^\/+/, '');
74
+ const candidate = path.resolve(rootReal, relative);
75
+ let targetReal;
76
+ try {
77
+ targetReal = fs.realpathSync(candidate);
78
+ }
79
+ catch (err) {
80
+ Logger.warn('Failed to find path %s', candidate, err);
81
+ response.statusCode = 403;
82
+ response.end('Forbidden');
83
+ return;
84
+ }
85
+ if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) {
86
+ response.statusCode = 403;
87
+ response.end('Forbidden');
88
+ return;
89
+ }
90
+ if (fs.existsSync(targetReal)) {
91
+ const stats = fs.statSync(targetReal);
68
92
  if (stats.isFile()) {
69
- let mimetype = mime.contentType(filePath);
93
+ let mimetype = mime.contentType(targetReal);
70
94
  if (mimetype === 'video/mp2t') {
71
95
  mimetype = 'text/x-typescript';
72
96
  }
73
- const buf = fs.readFileSync(filePath);
97
+ const buf = fs.readFileSync(targetReal);
74
98
  response.setHeader('Content-Type', mimetype);
75
99
  response.statusCode = 200;
76
100
  response.end(buf);
77
101
  }
78
102
  else if (stats.isDirectory()) {
79
- this.writeFolderListToResponse(reqPath, filePath, response);
103
+ this.writeFolderListToResponse(reqPath, targetReal, response);
80
104
  }
81
105
  }
82
106
  else {
@@ -1 +1 @@
1
- {"version":3,"file":"local-file-server.js","sourceRoot":"","sources":["../../src/http/local-file-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACnF,OAAO,IAAiD,MAAM,MAAM,CAAC;AACrE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AACtE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,YAAY,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAM9E,MAAM,OAAO,eAAe;IAKhB;IACA;IACA;IANF,MAAM,CAAS;IACf,OAAO,CAAS;IAExB,YACU,OAAe,IAAI,EACnB,QAAiB,KAAK,EACtB,WAAmB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAF3D,SAAI,GAAJ,IAAI,CAAe;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,aAAQ,GAAR,QAAQ,CAAmD;QAEnE,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzC,MAAM,YAAY,CAAC,IAAI,CAAC,8CAA8C,EAAE,QAAQ,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,IAAI,CAAC,0CAA0C,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,OAAO,CAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAEpF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG;wBACd,GAAG,EAAE,eAAe,CAAC,cAAc;wBACnC,IAAI,EAAE,eAAe,CAAC,eAAe;qBACtC,CAAC;oBACF,MAAM,CAAC,IAAI,CACT,4HAA4H,CAC7H,CAAC;oBACF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC5F,IAAI,CAAC,OAAO,GAAG,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClF,IAAI,CAAC,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC;gBACjD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAGxC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACxB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;oBAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAwB,EAAE,QAAwB;QACrE,MAAM,OAAO,GAAW,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACrH,MAAM,QAAQ,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAa,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,IAAI,QAAQ,GAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAE9B,QAAQ,GAAG,mBAAmB,CAAC;gBACjC,CAAC;gBACD,MAAM,GAAG,GAAW,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC9C,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC7C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAChD,QAAQ,CAAC,GAAG,CAAC,6BAA6B,OAAO,gBAAgB,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEM,yBAAyB,CAAC,OAAe,EAAE,GAAW,EAAE,QAAwB;QACrF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAEhD,IAAI,IAAI,GAAW,2BAA2B,GAAG,GAAG,GAAG,WAAW,CAAC;QAEnE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,GAAG,GAAW,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACnC,IAAI,IAAI,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC;QAClD,CAAC;QAED,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACnC,IAAI,OAAO,GAAW,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7C,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;YACrD,IAAI,IAAI,gBAAgB,OAAO,KAAK,IAAI,WAAW,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,qBAAqB,CAAC;QAE9B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAc;QAC9D,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAA2B,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxG,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,MAAM,KAAK,GAAY,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzF,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAoB,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAY,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;CACF"}
1
+ {"version":3,"file":"local-file-server.js","sourceRoot":"","sources":["../../src/http/local-file-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AACnF,OAAO,IAAiD,MAAM,MAAM,CAAC;AACrE,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AACtE,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,YAAY,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAM9E,MAAM,OAAO,eAAe;IAKhB;IACA;IACA;IANF,MAAM,CAAS;IACf,OAAO,CAAS;IAExB,YACU,OAAe,IAAI,EACnB,QAAiB,KAAK,EACtB,WAAmB,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAF3D,SAAI,GAAJ,IAAI,CAAe;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,aAAQ,GAAR,QAAQ,CAAmD;QAEnE,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzC,MAAM,YAAY,CAAC,IAAI,CAAC,8CAA8C,EAAE,QAAQ,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,CAAC,IAAI,CAAC,0CAA0C,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,IAAI,OAAO,CAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAEpF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG;wBACd,GAAG,EAAE,eAAe,CAAC,cAAc;wBACnC,IAAI,EAAE,eAAe,CAAC,eAAe;qBACtC,CAAC;oBACF,MAAM,CAAC,IAAI,CACT,4HAA4H,CAC7H,CAAC;oBACF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC5F,IAAI,CAAC,OAAO,GAAG,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClF,IAAI,CAAC,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC;gBACjD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAGxC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACxB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;oBAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACpB,GAAG,CAAC,IAAI,CAAC,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAwB,EAAE,QAAwB;QACrE,MAAM,OAAO,GAAW,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAGrH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACpE,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAE7C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC;QACf,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YACtD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAa,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,IAAI,QAAQ,GAAW,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;gBACpD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAE9B,QAAQ,GAAG,mBAAmB,CAAC;gBACjC,CAAC;gBACD,MAAM,GAAG,GAAW,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;gBAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC7C,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;YAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;YAChD,QAAQ,CAAC,GAAG,CAAC,6BAA6B,OAAO,gBAAgB,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEM,yBAAyB,CAAC,OAAe,EAAE,GAAW,EAAE,QAAwB;QACrF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAEhD,IAAI,IAAI,GAAW,2BAA2B,GAAG,GAAG,GAAG,WAAW,CAAC;QAEnE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,IAAI,GAAG,GAAW,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,GAAG,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACnC,IAAI,IAAI,eAAe,GAAG,GAAG,GAAG,eAAe,CAAC;QAClD,CAAC;QAED,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACnC,IAAI,OAAO,GAAW,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;YAC7C,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;YACrD,IAAI,IAAI,gBAAgB,OAAO,KAAK,IAAI,WAAW,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,IAAI,IAAI,qBAAqB,CAAC;QAE9B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAc;QAC9D,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAA2B,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxG,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,MAAM,KAAK,GAAY,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzF,MAAM,IAAI,GAAW,KAAK,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/E,MAAM,UAAU,GAAoB,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAY,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;CACF"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bitblit/ratchet-node-only",
3
- "version": "6.1.198-alpha",
3
+ "version": "6.1.199-alpha",
4
4
  "description": "Ratchet tools for use on node-only",
5
5
  "note-on-side-effects": "Technically the entries in 'bin' below might be side effects, but they are called explicitly",
6
6
  "sideEffects": false,
@@ -56,7 +56,7 @@
56
56
  },
57
57
  "license": "Apache-2.0",
58
58
  "dependencies": {
59
- "@bitblit/ratchet-common": "6.1.198-alpha"
59
+ "@bitblit/ratchet-common": "6.1.199-alpha"
60
60
  },
61
61
  "optionalDependencies": {
62
62
  "cheerio": "1.2.0",
@@ -68,7 +68,7 @@
68
68
  "warc": "1.0.1"
69
69
  },
70
70
  "peerDependencies": {
71
- "@bitblit/ratchet-common": "6.1.198-alpha",
71
+ "@bitblit/ratchet-common": "6.1.199-alpha",
72
72
  "cheerio": "^1.2.0",
73
73
  "csv-parse": "^6.2.1",
74
74
  "csv-stringify": "^6.7.0",
@@ -0,0 +1,17 @@
1
+ import https from "https";
2
+ import { LocalServerCert } from "./local-server-cert.js";
3
+ import { Agent } from "node:https";
4
+
5
+ /**
6
+ * This can be added to fetch RequestInit's on the node side to allow this particular
7
+ * cert to be used
8
+ */
9
+ export class LocalFileServerHttpsFetch {
10
+
11
+ public static createLocalFileServerAgent(): Agent {
12
+ return new https.Agent ({
13
+ ca: LocalServerCert.CLIENT_KEY_PEM
14
+ });
15
+ }
16
+
17
+ }
@@ -70,21 +70,51 @@ export class LocalFileServer {
70
70
 
71
71
  async requestHandler(request: IncomingMessage, response: ServerResponse): Promise<any> {
72
72
  const reqPath: string = request.url.includes('?') ? request.url.substring(0, request.url.indexOf('?')) : request.url;
73
- const filePath: string = path.join(this.fileRoot, reqPath);
74
- if (fs.existsSync(filePath)) {
75
- const stats: fs.Stats = fs.statSync(filePath);
73
+ //const filePath: string = path.join(this.fileRoot, reqPath);
74
+
75
+ const rootReal = fs.realpathSync(this.fileRoot);
76
+
77
+ const pathname = new URL(request.url ?? '/', this.urlRoot).pathname;
78
+ const decoded = decodeURIComponent(pathname);
79
+
80
+ if (decoded.includes('\0')) {
81
+ response.statusCode = 400;
82
+ response.end('Bad path');
83
+ return;
84
+ }
85
+
86
+ const relative = decoded.replace(/^\/+/, '');
87
+ const candidate = path.resolve(rootReal, relative);
88
+ let targetReal;
89
+ try {
90
+ targetReal = fs.realpathSync(candidate);
91
+ } catch (err) {
92
+ Logger.warn('Failed to find path %s', candidate, err);
93
+ response.statusCode = 403;
94
+ response.end('Forbidden');
95
+ return;
96
+ }
97
+
98
+ if (targetReal !== rootReal && !targetReal.startsWith(rootReal + path.sep)) {
99
+ response.statusCode = 403;
100
+ response.end('Forbidden');
101
+ return;
102
+ }
103
+
104
+ if (fs.existsSync(targetReal)) {
105
+ const stats: fs.Stats = fs.statSync(targetReal);
76
106
  if (stats.isFile()) {
77
- let mimetype: string = mime.contentType(filePath);
107
+ let mimetype: string = mime.contentType(targetReal);
78
108
  if (mimetype === 'video/mp2t') {
79
109
  // Not very likely for me!
80
110
  mimetype = 'text/x-typescript';
81
111
  }
82
- const buf: Buffer = fs.readFileSync(filePath);
112
+ const buf: Buffer = fs.readFileSync(targetReal);
83
113
  response.setHeader('Content-Type', mimetype);
84
114
  response.statusCode = 200;
85
115
  response.end(buf);
86
116
  } else if (stats.isDirectory()) {
87
- this.writeFolderListToResponse(reqPath, filePath, response);
117
+ this.writeFolderListToResponse(reqPath, targetReal, response);
88
118
  }
89
119
  } else {
90
120
  response.statusCode = 404;