@jamesmddoyle/phantom 0.2.4 → 0.2.6

package/dist/dashboard-ui/_app/version.json

@@ -1 +1 @@
-{"version":"1793227677261"}
+{"version":"1793230346425"}

package/dist/dashboard-ui/index.html

@@ -22,16 +22,16 @@
     <div style="display: contents">
 			<script>
 				{
-					__sveltekit_1m83ubh = {
+					__sveltekit_1qwiifu = {
 						base: "/_dashboard",
-						version: "1793227677261",
+						version: "1793230346425",
 						assets: "/_dashboard"
 					};
 
 					const element = document.currentScript.parentElement;
 
 					import("/_dashboard/_app/immutable/entry/start.DRnrjJWJ.js").then(async (kit) => {
-						kit.init(__sveltekit_1m83ubh);
+						kit.init(__sveltekit_1qwiifu);
 						const app = await import("/_dashboard/_app/immutable/entry/app.xWq8izru.js");
 						kit.start(app, element);
 					});

package/dist/index.js

@@ -63,9 +63,8 @@ server.on("connection", socket => {
     socketManager.add(socket);
     const socketID = `${socket.remoteAddress}:${socket.remotePort}`;
     let requestBuffer = Buffer.alloc(0);
-    // listen to raw data
-    // eslint-disable-next-line @typescript-eslint/no-misused-promises -- Nothing catches errors in this handler, so one bad request can stop the server.
-    socket.on("data", async (chunk) => {
+    let currentRequest = "";
+    async function handleData(chunk) {
         // if its a websocket connection, ignore the http parser
         if (wsClients.has(socketID))
             return;
@@ -73,6 +72,7 @@ server.on("connection", socket => {
         if (isRequestComplete(requestBuffer)) {
             const request = parseRequest(requestBuffer);
             if (request) {
+                currentRequest = `${request.method} ${request.path}`;
                 if (request.method === "OPTIONS") {
                     logger.info(`CORS Preflight ${request.path}`);
                     sendCorsPreflightResponse(socket);
@@ -113,51 +113,57 @@ server.on("connection", socket => {
                 const response = handleRouting(request);
                 request.params = response.params;
                 const isAdmin = request.path.startsWith("/_admin/");
-                let logEntry = null;
                 if (isAdmin && request.path === "/_admin/clear" && request.method === "POST") {
                     requestHistory.length = 0;
                     logger.admin("Request history cleared");
                 }
                 const delay = options.delay ?? response.delay ?? 0;
+                requestBuffer = Buffer.alloc(0);
                 if (delay > 0) {
                     logger.info(`Delaying response by ${delay}ms`);
+                    await new Promise(resolve => setTimeout(resolve, delay));
                 }
-                setTimeout(() => {
-                    if (socket.destroyed)
-                        return;
-                    const errorRate = options.errorRate ?? response.errorRate ?? 0;
-                    const shouldError = Math.random() < errorRate;
-                    if (!isAdmin) {
-                        logEntry = {
-                            id: crypto.randomUUID(),
-                            method: request.method,
-                            path: request.path,
-                            timestamp: start,
-                            headers: request.headers,
-                            body: request.body.toString("utf-8"),
-                            status: shouldError ? 500 : response.status,
-                            duration: Date.now() - start,
-                            responseBody: shouldError ? { error: "Artificial failure hit!" } : response.body,
-                        };
-                        requestHistory.push(logEntry);
-                        if (requestHistory.length > 100)
-                            requestHistory.shift();
-                        broadcast(wsClients, logEntry);
-                        // log the request
-                        logger.request(request.method, logEntry.status, request.path, logEntry.duration);
-                    }
-                    if (shouldError) {
-                        logger.error("Artificial failure hit!");
-                        sendResponse(socket, 500, "Internal Server Error", {
-                            error: "Artificial failure hit!",
-                        });
-                        return;
-                    }
-                    sendResponse(socket, response.status, response.message, response.body, response.headers);
-                }, delay);
-                requestBuffer = Buffer.alloc(0);
+                if (socket.destroyed)
+                    return;
+                const errorRate = options.errorRate ?? response.errorRate ?? 0;
+                const shouldError = Math.random() < errorRate;
+                if (!isAdmin) {
+                    const logEntry = {
+                        id: crypto.randomUUID(),
+                        method: request.method,
+                        path: request.path,
+                        timestamp: start,
+                        headers: request.headers,
+                        body: request.body.toString("utf-8"),
+                        status: shouldError ? 500 : response.status,
+                        duration: Date.now() - start,
+                        responseBody: shouldError ? { error: "Artificial failure hit!" } : response.body,
+                    };
+                    requestHistory.push(logEntry);
+                    if (requestHistory.length > 100)
+                        requestHistory.shift();
+                    broadcast(wsClients, logEntry);
+                    logger.request(request.method, logEntry.status, request.path, logEntry.duration);
+                }
+                if (shouldError) {
+                    logger.error("Artificial failure hit!");
+                    sendResponse(socket, 500, "Internal Server Error", {
+                        error: "Artificial failure hit!",
+                    });
+                    return;
+                }
+                sendResponse(socket, response.status, response.message, response.body, response.headers);
             }
         }
+    }
+    socket.on("data", (chunk) => {
+        handleData(chunk).catch((error) => {
+            requestBuffer = Buffer.alloc(0);
+            logger.error(`Failed to handle ${currentRequest || "a request"}`, error);
+            if (socket.writableEnded || socket.destroyed)
+                return;
+            sendResponse(socket, 500, "Internal Server Error", { error: "Internal server error" });
+        });
     });
     socket.on("close", () => {
         socketManager.remove(socket);

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jamesmddoyle/phantom",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "API mocker and traffic inspector with a built-in dashboard.",
   "author": "James Doyle",
   "license": "MIT",
@@ -10,7 +10,7 @@
     "directory": "server"
   },
   "bin": {
-    "phantom": "./dist/index.js"
+    "phantom": "dist/index.js"
   },
   "files": [
     "dist",

package/dist/router.js

@@ -1,6 +1,9 @@
 import { getActiveRoutes, writeRoutes } from "./config.js";
 import { VERSION } from "./index.js";
 export function handleRouting(request, customRoutes) {
+    if (!hasValidEncoding(request.path)) {
+        return { status: 400, message: "Bad Request", body: { error: `Path ${request.path} has invalid percent-encoding` }, params: {} };
+    }
     if (request.path === "/_admin/version" && request.method === "GET") {
         return { status: 200, message: "OK", body: { version: VERSION }, params: {} };
     }
@@ -39,12 +42,32 @@ export function handleRouting(request, customRoutes) {
         params: {},
     };
 }
+/**
+ * Checks that the path part of a request path can be percent-decoded.
+ */
+function hasValidEncoding(requestPath) {
+    try {
+        decodeURIComponent(requestPath.split("?")[0] ?? "");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Escapes the characters that have a special meaning in a regular expression.
+ */
+function escapeRegExp(text) {
+    // "$&" puts back the character that matched, after the backslash.
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 /**
  * Matches a request path against a pattern like /users/:id.
+ * Everything except the :params matches literally.
  */
 function matchPath(pattern, actualPath) {
     const paramNames = [];
-    const regexPath = pattern.replace(/:([a-zA-Z0-9_]+)/g, (_, name) => {
+    const regexPath = escapeRegExp(pattern).replace(/:([a-zA-Z0-9_]+)/g, (_, name) => {
         paramNames.push(name);
         return "([^/]+)";
     });

package/dist/static.js

@@ -11,7 +11,29 @@ const MIME_TYPES = {
     ".json": "application/json",
 };
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-export async function handleStaticFile(requestPath) {
+/** The published build first, then the repo build during development. */
+const DASHBOARD_FOLDERS = [path.join(__dirname, "dashboard-ui"), path.join(__dirname, "../dashboard/build")];
+/**
+ * Decodes a request path and joins it onto the folder.
+ * Returns null when the path can't be decoded or ends up outside the folder.
+ */
+function resolveInside(folder, requestPath) {
+    let decodedPath;
+    try {
+        decodedPath = decodeURIComponent(requestPath);
+    }
+    catch {
+        return null;
+    }
+    const filePath = path.join(folder, decodedPath);
+    const isInside = filePath === folder || filePath.startsWith(folder + path.sep);
+    return isInside ? filePath : null;
+}
+/**
+ * Finds the dashboard file for a request. Returns null when the request isn't for the dashboard,
+ * or when its path leaves the dashboard folder, so the request ends in a 404.
+ */
+export async function handleStaticFile(requestPath, folders = DASHBOARD_FOLDERS) {
     const isDashboardBase = requestPath.startsWith("/_dashboard");
     const isAppAsset = requestPath.startsWith("/_app");
     const isPhantomSVG = requestPath === "/phantom.svg";
@@ -23,9 +45,10 @@ export async function handleStaticFile(requestPath) {
     }
     if (cleanPath === "" || cleanPath === "/")
         cleanPath = "/index.html";
-    // check production path first, then development path
-    const paths = [path.join(__dirname, "dashboard-ui", cleanPath), path.join(__dirname, "../dashboard/build", cleanPath)];
-    for (const filePath of paths) {
+    for (const folder of folders) {
+        const filePath = resolveInside(folder, cleanPath);
+        if (!filePath)
+            return null;
         try {
             const content = await fs.readFile(filePath);
             const ext = path.extname(filePath);
@@ -41,10 +64,9 @@ export async function handleStaticFile(requestPath) {
         }
     }
     // SPA fallback for /_dashboard sub-routes
-    const fallbackPaths = [path.join(__dirname, "dashboard-ui", "index.html"), path.join(__dirname, "../dashboard/build", "index.html")];
-    for (const fallback of fallbackPaths) {
+    for (const folder of folders) {
         try {
-            const indexContent = await fs.readFile(fallback);
+            const indexContent = await fs.readFile(path.join(folder, "index.html"));
             return { body: indexContent, headers: { "Content-Type": "text/html" } };
         }
         catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jamesmddoyle/phantom",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "API mocker and traffic inspector with a built-in dashboard.",
   "author": "James Doyle",
   "license": "MIT",
@@ -10,7 +10,7 @@
     "directory": "server"
   },
   "bin": {
-    "phantom": "./dist/index.js"
+    "phantom": "dist/index.js"
   },
   "files": [
     "dist",