@jnode/server 2.2.0 → 2.2.2

package/README.md

@@ -401,7 +401,9 @@ Serves a single file with support for HTTP Range requests, caching headers, and
 ### Handler: `FolderHandler(folder[, options])`
 
 - `folder` [\<string\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#string_type) Path to the folder to serve files from.
-- `options` [\<Object\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object) Same as [`FileHandler` options](#handler-filehandlerfile-options).
+- `options` [\<Object\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object)
+  - `allowHiddenFile` [\<boolean\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#boolean_type) Allows access to hidden directories and files (whose names begin with `.`).
+  - Same as [`FileHandler` options](#handler-filehandlerfile-options).
 
 Serves files from a folder based on remaining path segments. Automatically resolves paths and prevents directory traversal attacks. Internally uses `FileHandler`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jnode/server",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Simple web server package for Node.js.",
   "main": "src/index.js",
   "scripts": {

package/src/handlers.js

@@ -183,6 +183,7 @@ class FolderHandler {
         const file = path.resolve(this.folder, ...env.path.slice(env.pathPointer));
 
         // safety check
+        if (file.includes(path.sep + '.') && !this.options.allowHiddenFile) throw 404;
         const rel = path.relative(this.folder, file);
         if (rel.startsWith('..') || path.isAbsolute(rel)) throw 404;
 
@@ -220,18 +221,17 @@ class RedirectHandler {
 
         // prebuild headers
         this._statusCode = this.options.statusCode ?? 307;
-        this._headers = {
+    }
+
+    handle(ctx, env) {
+        ctx.res.writeHead(this._statusCode, {
             'Location': this.options.base ?
                 this.options.base +
                 (this.options.base.endsWith('/') ? '' : '/') +
                 env.path.slice(env.pathPointer).map(encodeURIComponent).join('/') :
                 this.location,
             ...this.options.headers
-        };
-    }
-
-    handle(ctx, env) {
-        ctx.res.writeHead(this._statusCode, this._headers);
+        });
         ctx.res.end();
     }
 }