@jsenv/server 17.6.6 → 17.6.7

package/dist/jsenv_server.js

@@ -1150,6 +1150,62 @@ const stringifyHeaderProperty = ({ name, value }) => {
   return `${name}=${value}`;
 };
 
+/*
+ * A request target is the text between the method and the http version on the
+ * request line (RFC 9112 section 3.2), or the ":path" pseudo header in http2.
+ * It is a path, not a url reference, and the two must never be confused:
+ * "//wp-includes/x" is an origin-form target whose first path segment is
+ * empty, but `new URL("//wp-includes/x", origin)` reads it as a
+ * protocol-relative reference and turns "wp-includes" into the host. So the
+ * path is assigned onto the origin instead, and what a client sends can never
+ * replace that origin.
+ *
+ * The one form that legitimately names an origin is absolute-form
+ * ("GET http://host/path", sent by proxies and open-proxy scanners); it is
+ * read as such so the origin it names goes through the allowedHosts check
+ * like any other host, instead of reaching the routes unchecked.
+ */
+
+const ABSOLUTE_FORM_REGEX = /^[a-z][a-z0-9+\-.]*:\/\//i;
+
+/**
+ * @param {string} target the raw request target
+ * @returns {{ origin: string|null, host: string|null, resource: string }|null}
+ *   null when the target cannot be read; the server answers 400
+ */
+const readRequestTarget = (target) => {
+  if (!ABSOLUTE_FORM_REGEX.test(target)) {
+    // origin-form ("/path?query"), asterisk-form ("*") or authority-form
+    return { origin: null, host: null, resource: target };
+  }
+  if (!URL.canParse(target)) {
+    return null;
+  }
+  const urlObject = new URL(target);
+  if (urlObject.protocol !== "http:" && urlObject.protocol !== "https:") {
+    return null;
+  }
+  return {
+    origin: urlObject.origin,
+    host: urlObject.host,
+    resource: `${urlObject.pathname}${urlObject.search}`,
+  };
+};
+
+// the search of baseUrl is dropped: the resource carries its own
+const resourceToUrlObject = (resource, baseUrl) => {
+  const urlObject = new URL(baseUrl);
+  const searchSeparatorIndex = resource.indexOf("?");
+  if (searchSeparatorIndex === -1) {
+    urlObject.pathname = resource;
+    urlObject.search = "";
+  } else {
+    urlObject.pathname = resource.slice(0, searchSeparatorIndex);
+    urlObject.search = resource.slice(searchSeparatorIndex);
+  }
+  return urlObject;
+};
+
 // https://wicg.github.io/observable/#core-infrastructure
 
 if ("observable" in Symbol === false) {
@@ -1329,8 +1385,13 @@ const fromNodeRequest = (
   nodeRequest.pause();
   const body = observableFromNodeStream(nodeRequest);
 
+  // an absolute-form target names the origin the request is for; the host
+  // header is ignored in that case (RFC 9112 section 3.3)
+  const requestTarget = readRequestTarget(nodeRequest.url);
   let requestOrigin;
-  if (nodeRequest.upgrade) {
+  if (requestTarget.origin) {
+    requestOrigin = requestTarget.origin;
+  } else if (nodeRequest.upgrade) {
     requestOrigin = serverOrigin;
   } else if (nodeRequest.authority) {
     requestOrigin = nodeRequest.connection.encrypted
@@ -1463,7 +1524,7 @@ const fromNodeRequest = (
     http2: Boolean(nodeRequest.stream),
     origin: requestOrigin,
     ...getPropertiesFromResource({
-      resource: nodeRequest.url,
+      resource: requestTarget.resource,
       baseUrl: requestOrigin,
     }),
     method: nodeRequest.method,
@@ -1690,13 +1751,12 @@ const applyRedirectionToRequest = (
   };
 };
 const getPropertiesFromResource = ({ resource, baseUrl }) => {
-  const urlObject = new URL(resource, baseUrl);
-  let pathname = urlObject.pathname;
+  const urlObject = resourceToUrlObject(resource, baseUrl);
 
   return {
     url: String(urlObject),
     searchParams: urlObject.searchParams,
-    pathname,
+    pathname: urlObject.pathname,
     resource,
   };
 };
@@ -5833,8 +5893,17 @@ const createResourcePattern = (pattern) => {
   }
 
   const patternEndsWithSlash = pathnamePatternString.endsWith("/");
+  // a pattern constraining nothing: every resource matches it, so whoever uses
+  // it cannot name the resource that matched
+  const matchesEveryResource =
+    !searchPattern &&
+    !hashPattern &&
+    (pathnamePatternString === "*" ||
+      pathnamePatternString === "/" ||
+      pathnamePatternString === "/*");
 
   return {
+    matchesEveryResource,
     match: (resource) => {
       const [pathname, search, hash] = resourceToParts(resource);
       let decodedPathname = decodeURIComponent(pathname);
@@ -6477,9 +6546,9 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         }
         if (!route.matchMethod(request.method)) {
           // a 405 asserts the resource exists with other methods: a route
-          // matching any resource ("GET *") cannot assert that, so it does
-          // not turn an unknown resource into a 405
-          if (!route.isFallback && route.resource !== "*") {
+          // matching every resource ("GET *", "GET /") names no resource, so
+          // it cannot make that assertion and an unknown address stays a 404
+          if (!route.isFallback && !route.matchesEveryResource) {
             wouldHaveMatched.methodSet.add(route.method);
           }
           continue;
@@ -6827,6 +6896,8 @@ const createRoute = ({
         : (requestResource) => {
             return resourcePattern.match(requestResource);
           },
+    matchesEveryResource:
+      resource === "*" || resourcePattern.matchesEveryResource,
     matchHeaders:
       headers === undefined
         ? () => true
@@ -7972,7 +8043,14 @@ const startServer = async ({
 
   {
     const requestEventHandler = async (nodeRequest, nodeResponse) => {
-      const requestHost = nodeRequest.authority || nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        nodeResponse.writeHead(400, "Request url is not supported");
+        nodeResponse.end();
+        return;
+      }
+      const requestHost =
+        requestTarget.host || nodeRequest.authority || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -7983,19 +8061,11 @@ const startServer = async ({
       }
       if (redirectHttpToHttps && !nodeRequest.connection.encrypted) {
         nodeResponse.writeHead(301, {
-          location: `${serverOrigin}${nodeRequest.url}`,
+          location: `${serverOrigin}${requestTarget.resource}`,
         });
         nodeResponse.end();
         return;
       }
-      try {
-        // eslint-disable-next-line no-new
-        new URL(nodeRequest.url, "http://example.com");
-      } catch {
-        nodeResponse.writeHead(400, "Request url is not supported");
-        nodeResponse.end();
-        return;
-      }
 
       const [receiveRequestOperation, sendResponseOperation] =
         prepareHandleRequestOperations(nodeRequest, nodeResponse);
@@ -8072,7 +8142,13 @@ const startServer = async ({
     };
     // https://github.com/websockets/ws/blob/b92745a9d6760e6b4b2394bfac78cbcd258a8c8d/lib/websocket-server.js#L491
     const upgradeEventHandler = async (nodeRequest, socket, head) => {
-      const requestHost = nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        socket.write(`HTTP/1.1 400 Request url is not supported\r\n\r\n`);
+        socket.destroy();
+        return;
+      }
+      const requestHost = requestTarget.host || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -8987,8 +9063,11 @@ const fetchFileSystem = async (
   if (request.params && "0" in request.params) {
     resource = request.params["0"];
   } else {
-    resource = request.resource.slice(1);
+    resource = request.resource;
   }
+  // the resource is resolved against the served directory, so it must stay a
+  // relative reference: a leading slash would resolve to the filesystem root
+  resource = resource.replace(/^\/+/, "");
   const filesystemUrl = new URL(resource, directoryUrlString);
   const urlString = asUrlString(filesystemUrl);
   if (!urlIsOrIsInsideOf(urlString, directoryUrlString)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.6.6",
+  "version": "17.6.7",
   "type": "module",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {

package/src/interfacing_with_node/from_node_request.js

@@ -20,6 +20,10 @@ import {
 } from "../internal/colorize_response_status.js";
 import { headersFromObject } from "../internal/headers_from_object.js";
 import { parseSingleHeaderWithAttributes } from "../internal/multiple_header.js";
+import {
+  readRequestTarget,
+  resourceToUrlObject,
+} from "../internal/request_target.js";
 import { observableFromNodeStream } from "./observable_from_node_stream.js";
 
 export const fromNodeRequest = (
@@ -66,8 +70,13 @@ export const fromNodeRequest = (
   nodeRequest.pause();
   const body = observableFromNodeStream(nodeRequest);
 
+  // an absolute-form target names the origin the request is for; the host
+  // header is ignored in that case (RFC 9112 section 3.3)
+  const requestTarget = readRequestTarget(nodeRequest.url);
   let requestOrigin;
-  if (nodeRequest.upgrade) {
+  if (requestTarget.origin) {
+    requestOrigin = requestTarget.origin;
+  } else if (nodeRequest.upgrade) {
     requestOrigin = serverOrigin;
   } else if (nodeRequest.authority) {
     requestOrigin = nodeRequest.connection.encrypted
@@ -200,7 +209,7 @@ export const fromNodeRequest = (
     http2: Boolean(nodeRequest.stream),
     origin: requestOrigin,
     ...getPropertiesFromResource({
-      resource: nodeRequest.url,
+      resource: requestTarget.resource,
       baseUrl: requestOrigin,
     }),
     method: nodeRequest.method,
@@ -440,13 +449,12 @@ export const applyRedirectionToRequest = (
   };
 };
 const getPropertiesFromResource = ({ resource, baseUrl }) => {
-  const urlObject = new URL(resource, baseUrl);
-  let pathname = urlObject.pathname;
+  const urlObject = resourceToUrlObject(resource, baseUrl);
 
   return {
     url: String(urlObject),
     searchParams: urlObject.searchParams,
-    pathname,
+    pathname: urlObject.pathname,
     resource,
   };
 };

package/src/internal/request_target.js

@@ -0,0 +1,55 @@
+/*
+ * A request target is the text between the method and the http version on the
+ * request line (RFC 9112 section 3.2), or the ":path" pseudo header in http2.
+ * It is a path, not a url reference, and the two must never be confused:
+ * "//wp-includes/x" is an origin-form target whose first path segment is
+ * empty, but `new URL("//wp-includes/x", origin)` reads it as a
+ * protocol-relative reference and turns "wp-includes" into the host. So the
+ * path is assigned onto the origin instead, and what a client sends can never
+ * replace that origin.
+ *
+ * The one form that legitimately names an origin is absolute-form
+ * ("GET http://host/path", sent by proxies and open-proxy scanners); it is
+ * read as such so the origin it names goes through the allowedHosts check
+ * like any other host, instead of reaching the routes unchecked.
+ */
+
+const ABSOLUTE_FORM_REGEX = /^[a-z][a-z0-9+\-.]*:\/\//i;
+
+/**
+ * @param {string} target the raw request target
+ * @returns {{ origin: string|null, host: string|null, resource: string }|null}
+ *   null when the target cannot be read; the server answers 400
+ */
+export const readRequestTarget = (target) => {
+  if (!ABSOLUTE_FORM_REGEX.test(target)) {
+    // origin-form ("/path?query"), asterisk-form ("*") or authority-form
+    return { origin: null, host: null, resource: target };
+  }
+  if (!URL.canParse(target)) {
+    return null;
+  }
+  const urlObject = new URL(target);
+  if (urlObject.protocol !== "http:" && urlObject.protocol !== "https:") {
+    return null;
+  }
+  return {
+    origin: urlObject.origin,
+    host: urlObject.host,
+    resource: `${urlObject.pathname}${urlObject.search}`,
+  };
+};
+
+// the search of baseUrl is dropped: the resource carries its own
+export const resourceToUrlObject = (resource, baseUrl) => {
+  const urlObject = new URL(baseUrl);
+  const searchSeparatorIndex = resource.indexOf("?");
+  if (searchSeparatorIndex === -1) {
+    urlObject.pathname = resource;
+    urlObject.search = "";
+  } else {
+    urlObject.pathname = resource.slice(0, searchSeparatorIndex);
+    urlObject.search = resource.slice(searchSeparatorIndex);
+  }
+  return urlObject;
+};

package/src/plugins/filesystem/fetch_file.js

@@ -112,8 +112,11 @@ export const fetchFileSystem = async (
   if (request.params && "0" in request.params) {
     resource = request.params["0"];
   } else {
-    resource = request.resource.slice(1);
+    resource = request.resource;
   }
+  // the resource is resolved against the served directory, so it must stay a
+  // relative reference: a leading slash would resolve to the filesystem root
+  resource = resource.replace(/^\/+/, "");
   const filesystemUrl = new URL(resource, directoryUrlString);
   const urlString = asUrlString(filesystemUrl);
   if (!urlIsOrIsInsideOf(urlString, directoryUrlString)) {

package/src/router/router.js

@@ -356,9 +356,9 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         }
         if (!route.matchMethod(request.method)) {
           // a 405 asserts the resource exists with other methods: a route
-          // matching any resource ("GET *") cannot assert that, so it does
-          // not turn an unknown resource into a 405
-          if (!route.isFallback && route.resource !== "*") {
+          // matching every resource ("GET *", "GET /") names no resource, so
+          // it cannot make that assertion and an unknown address stays a 404
+          if (!route.isFallback && !route.matchesEveryResource) {
             wouldHaveMatched.methodSet.add(route.method);
           }
           continue;
@@ -709,6 +709,8 @@ const createRoute = ({
         : (requestResource) => {
             return resourcePattern.match(requestResource);
           },
+    matchesEveryResource:
+      resource === "*" || resourcePattern.matchesEveryResource,
     matchHeaders:
       headers === undefined
         ? () => true

package/src/start_server.js

@@ -18,6 +18,7 @@ import { listen, stopListening } from "./internal/listen.js";
 import { listenEvent } from "./internal/listen_event.js";
 import { listenRequest } from "./internal/listen_request.js";
 import { listenServerConnectionError } from "./internal/listen_server_connection_error.js";
+import { readRequestTarget } from "./internal/request_target.js";
 import { composeTwoResponses } from "./internal/response_composition.js";
 import { createSecureServer } from "./internal/secure_server.js";
 import { resolveServerOrigins } from "./internal/server_origins.js";
@@ -792,7 +793,14 @@ export const startServer = async ({
 
   request: {
     const requestEventHandler = async (nodeRequest, nodeResponse) => {
-      const requestHost = nodeRequest.authority || nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        nodeResponse.writeHead(400, "Request url is not supported");
+        nodeResponse.end();
+        return;
+      }
+      const requestHost =
+        requestTarget.host || nodeRequest.authority || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,
@@ -803,19 +811,11 @@ export const startServer = async ({
       }
       if (redirectHttpToHttps && !nodeRequest.connection.encrypted) {
         nodeResponse.writeHead(301, {
-          location: `${serverOrigin}${nodeRequest.url}`,
+          location: `${serverOrigin}${requestTarget.resource}`,
         });
         nodeResponse.end();
         return;
       }
-      try {
-        // eslint-disable-next-line no-new
-        new URL(nodeRequest.url, "http://example.com");
-      } catch {
-        nodeResponse.writeHead(400, "Request url is not supported");
-        nodeResponse.end();
-        return;
-      }
 
       const [receiveRequestOperation, sendResponseOperation] =
         prepareHandleRequestOperations(nodeRequest, nodeResponse);
@@ -897,7 +897,13 @@ export const startServer = async ({
     };
     // https://github.com/websockets/ws/blob/b92745a9d6760e6b4b2394bfac78cbcd258a8c8d/lib/websocket-server.js#L491
     const upgradeEventHandler = async (nodeRequest, socket, head) => {
-      const requestHost = nodeRequest.headers.host;
+      const requestTarget = readRequestTarget(nodeRequest.url);
+      if (!requestTarget) {
+        socket.write(`HTTP/1.1 400 Request url is not supported\r\n\r\n`);
+        socket.destroy();
+        return;
+      }
+      const requestHost = requestTarget.host || nodeRequest.headers.host;
       if (!isHostAllowed(requestHost)) {
         logger.warn(
           `${nodeRequest.method} ${nodeRequest.url} refused: host "${requestHost}" is not allowed (see the allowedHosts option)`,