@furystack/rest-service 14.1.2 → 14.1.4

package/src/static-server-manager.spec.ts

@@ -1,6 +1,10 @@
 import { getPort } from '@furystack/core/port-generator'
 import { createInjector } from '@furystack/inject'
 import { sleepAsync, usingAsync } from '@furystack/utils'
+import { mkdtemp, mkdir, rm, writeFile } from 'fs/promises'
+import { request } from 'http'
+import { tmpdir } from 'os'
+import { join } from 'path'
 import { describe, expect, it, vi } from 'vitest'
 import { useStaticFiles } from './helpers.js'
 import { HttpServerPoolToken } from './http-server-pool.js'
@@ -74,6 +78,41 @@ describe('useStaticFiles / buildStaticSiteServerApi', () => {
         expect(result.headers.get('content-type')).toBe('text/markdown')
       })
     })
+
+    it('rejects path traversal outside the static root', async () => {
+      const root = await mkdtemp(join(tmpdir(), 'furystack-static-'))
+      try {
+        const publicDir = join(root, 'public')
+        await mkdir(publicDir)
+        await writeFile(join(publicDir, 'ok.txt'), 'ok', 'utf-8')
+        await writeFile(join(root, 'secret.txt'), 'secret', 'utf-8')
+
+        await usingAsync(createInjector(), async (i) => {
+          const port = getPort()
+          await useStaticFiles({ injector: i, baseUrl: '/static', path: publicDir, port })
+
+          const { statusCode, body } = await new Promise<{ statusCode: number; body: string }>((fulfill, reject) => {
+            const req = request(
+              { hostname: '127.0.0.1', port, path: '/static/../secret.txt', method: 'GET' },
+              (res) => {
+                let data = ''
+                res.on('data', (chunk) => {
+                  data += String(chunk)
+                })
+                res.on('end', () => fulfill({ statusCode: res.statusCode ?? 0, body: data }))
+              },
+            )
+            req.on('error', reject)
+            req.end()
+          })
+
+          expect(statusCode).toBe(404)
+          expect(body).not.toBe('secret')
+        })
+      } finally {
+        await rm(root, { recursive: true, force: true })
+      }
+    })
   })
 
   describe('Non-top level routing', () => {

package/src/static-site-runtime.spec.ts

@@ -1,4 +1,9 @@
+import { getPort } from '@furystack/core/port-generator'
 import type { IncomingMessage, ServerResponse } from 'http'
+import { createServer, request } from 'http'
+import { mkdtemp, rm, writeFile } from 'fs/promises'
+import { tmpdir } from 'os'
+import { join } from 'path'
 import { describe, expect, it } from 'vitest'
 import { buildStaticSiteServerApi } from './static-site-runtime.js'
 
@@ -37,3 +42,35 @@ describe('buildStaticSiteServerApi / shouldExec', () => {
     expect(api.onUpgrade).toBeUndefined()
   })
 })
+
+describe('buildStaticSiteServerApi / onRequest stream lifecycle', () => {
+  it('resolves when the client disconnects mid-stream', async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'furystack-static-'))
+    const file = join(dir, 'big.txt')
+    await writeFile(file, 'x'.repeat(1024 * 1024))
+    const port = getPort()
+    const api = buildStaticSiteServerApi({ baseUrl: '/', path: dir, port })
+    const server = createServer((req, res) => {
+      void api.onRequest({ req, res }).catch(() => undefined)
+    })
+
+    try {
+      await new Promise<void>((resolve) => server.listen(port, '127.0.0.1', resolve))
+      const settled = await new Promise<string>((resolve, reject) => {
+        const req = request({ hostname: '127.0.0.1', port, path: '/big.txt', method: 'GET' }, (res) => {
+          res.once('data', () => {
+            req.destroy()
+            setTimeout(() => resolve('ok'), 100)
+          })
+        })
+        req.on('error', () => undefined)
+        req.end()
+        setTimeout(() => reject(new Error('timeout')), 1000)
+      })
+      expect(settled).toBe('ok')
+    } finally {
+      await new Promise<void>((resolve, reject) => server.close((err) => (err ? reject(err) : resolve())))
+      await rm(dir, { recursive: true, force: true })
+    }
+  })
+})

package/src/static-site-runtime.ts

@@ -2,7 +2,7 @@ import { PathHelper } from '@furystack/utils'
 import { createReadStream } from 'fs'
 import { access, stat } from 'fs/promises'
 import type { IncomingMessage, OutgoingHttpHeaders, ServerResponse } from 'http'
-import { join, normalize, sep } from 'path'
+import { resolve, sep } from 'path'
 import type { ServerApi } from './http-server-pool.js'
 import { getMimeForFile } from './mime-types.js'
 
@@ -35,10 +35,26 @@ const sendFile = async ({
     'Content-Length': size,
     'Content-Type': getMimeForFile(fullPath),
   }
-  Object.entries(head).forEach(([key, value]) => res.setHeader(key, value))
-  await new Promise<void>((resolve, reject) =>
-    createReadStream(fullPath, { autoClose: true }).once('finish', resolve).once('error', reject).pipe(res),
-  )
+  Object.entries(head).forEach(([key, value]) => {
+    if (value !== undefined) {
+      res.setHeader(key, value)
+    }
+  })
+  await new Promise<void>((done, reject) => {
+    const stream = createReadStream(fullPath, { autoClose: true })
+    const onError = (error: Error) => {
+      stream.destroy()
+      reject(error)
+    }
+    stream.once('error', onError)
+    res.once('error', onError)
+    res.once('close', () => {
+      stream.destroy()
+      done()
+    })
+    res.once('finish', done)
+    stream.pipe(res)
+  })
 }
 
 /**
@@ -47,16 +63,33 @@ const sendFile = async ({
  * `options.fallback` (if set) for missing files, otherwise responds with 404.
  */
 export const buildStaticSiteServerApi = (options: StaticServerOptions): ServerApi => {
+  const rootPath = resolve(options.path)
+  const isInsideRoot = (filePath: string) => filePath === rootPath || filePath.startsWith(`${rootPath}${sep}`)
+
   const onRequest = async ({ req, res }: { req: IncomingMessage; res: ServerResponse }): Promise<void> => {
     const extractedPath = PathHelper.extractPath(req.url as string, options.baseUrl)
     const filePath = (extractedPath || '/').replaceAll('/', sep)
-    const fullPath = normalize(join(options.path, filePath))
+    const fullPath = resolve(rootPath, `.${sep}${filePath}`)
+
+    if (!isInsideRoot(fullPath)) {
+      res.writeHead(404, { 'Content-Type': 'text/plain' })
+      res.end('Not found')
+      return
+    }
+
     try {
       await sendFile({ fullPath, res, headers: options.headers })
     } catch {
       if (options.fallback) {
-        await sendFile({ fullPath: normalize(join(options.path, options.fallback)), res, headers: options.headers })
-        return
+        const fallbackPath = resolve(rootPath, options.fallback)
+        if (isInsideRoot(fallbackPath)) {
+          try {
+            await sendFile({ fullPath: fallbackPath, res, headers: options.headers })
+            return
+          } catch {
+            // fall through to 404
+          }
+        }
       }
       res.writeHead(404, { 'Content-Type': 'text/plain' })
       res.end('Not found')