jishushell 0.6.5 → 0.6.18

package/node_modules/@fastify/static/index.js

@@ -117,12 +117,21 @@ async function fastifyStatic (fastify, opts) {
       throw new TypeError('"wildcard" option must be a boolean')
     }
     if (opts.wildcard === undefined || opts.wildcard === true) {
+      let matchRoutePrefix
+
       fastify.route({
         ...routeOpts,
         method: ['HEAD', 'GET'],
         path: prefix + '*',
         handler (req, reply) {
-          pumpSendToReply(req, reply, '/' + req.params['*'], sendOptions.root)
+          matchRoutePrefix ??= createRoutePrefixMatcher(req.routeOptions.url)
+
+          const pathname = getPathnameForSend(req.raw.url, matchRoutePrefix)
+          if (!pathname) {
+            return reply.callNotFound()
+          }
+
+          pumpSendToReply(req, reply, pathname, sendOptions.root)
         }
       })
       if (opts.redirect === true && prefix !== opts.prefix) {
@@ -176,6 +185,29 @@ async function fastifyStatic (fastify, opts) {
 
   const allowedPath = opts.allowedPath
 
+  /**
+   * @param {import("fastify").FastifyReply} reply
+   * @param {string} pathname
+   * @return {Promise<boolean>}
+   */
+  async function sendDirectoryList (reply, pathname) {
+    const dir = dirList.path(opts.root, pathname)
+    if (!dir) {
+      return false
+    }
+
+    await dirList.send({
+      reply,
+      dir,
+      options: opts.list,
+      route: pathname,
+      prefix,
+      dotfiles: opts.dotfiles
+    }).catch((err) => reply.send(err))
+
+    return true
+  }
+
   /**
    * @param {import("fastify").FastifyRequest} request
    * @param {import("fastify").FastifyReply} reply
@@ -274,7 +306,7 @@ async function fastifyStatic (fastify, opts) {
               pathname + '/',
               rootPath,
               undefined,
-              undefined,
+              pumpOptions,
               checkedEncodings
             )
           }
@@ -289,15 +321,7 @@ async function fastifyStatic (fastify, opts) {
           (!options.index || !options.index.length) &&
           pathnameForSend[pathnameForSend.length - 1] === '/'
         ) {
-          if (opts.list) {
-            await dirList.send({
-              reply,
-              dir: dirList.path(opts.root, pathname),
-              options: opts.list,
-              route: pathname,
-              prefix,
-              dotfiles: opts.dotfiles
-            }).catch((err) => reply.send(err))
+          if (opts.list && await sendDirectoryList(reply, pathname)) {
             return
           }
         }
@@ -314,7 +338,7 @@ async function fastifyStatic (fastify, opts) {
                   pathname + '/',
                   rootPath,
                   undefined,
-                  undefined,
+                  pumpOptions,
                   checkedEncodings
                 )
               }
@@ -322,21 +346,21 @@ async function fastifyStatic (fastify, opts) {
           }
 
           // if file exists, send real file, otherwise send dir list if name match
-          if (opts.list && dirList.handle(pathname, opts.list)) {
-            await dirList.send({
-              reply,
-              dir: dirList.path(opts.root, pathname),
-              options: opts.list,
-              route: pathname,
-              prefix,
-              dotfiles: opts.dotfiles
-            }).catch((err) => reply.send(err))
+          if (opts.list && dirList.handle(pathname, opts.list) && await sendDirectoryList(reply, pathname)) {
             return
           }
 
           // root paths left to try?
           if (Array.isArray(rootPath) && rootPathOffset < (rootPath.length - 1)) {
-            return pumpSendToReply(request, reply, pathname, rootPath, rootPathOffset + 1)
+            return pumpSendToReply(
+              request,
+              reply,
+              pathname,
+              rootPath,
+              rootPathOffset + 1,
+              pumpOptions,
+              undefined
+            )
           }
 
           if (opts.preCompressed && !checkedEncodings.has(encoding)) {
@@ -347,7 +371,7 @@ async function fastifyStatic (fastify, opts) {
               pathnameOrig,
               rootPath,
               rootPathOffset,
-              undefined,
+              pumpOptions,
               checkedEncodings
             )
           }
@@ -548,6 +572,128 @@ function getEncodingHeader (headers, checked) {
   )
 }
 
+/**
+ * @param {string} routePrefix
+ * @returns {Array<string|undefined>}
+ */
+function createRoutePrefixTokens (routePrefix) {
+  const tokens = []
+  let routeIndex = 0
+  let segmentStart = 0
+
+  while (routeIndex < routePrefix.length) {
+    if (routePrefix[routeIndex] !== ':') {
+      routeIndex++
+      continue
+    }
+
+    if (segmentStart !== routeIndex) {
+      tokens.push(routePrefix.slice(segmentStart, routeIndex))
+    }
+
+    routeIndex++
+    while (routeIndex < routePrefix.length && routePrefix[routeIndex] !== '/') {
+      routeIndex++
+    }
+
+    tokens.push(undefined)
+    segmentStart = routeIndex
+  }
+
+  if (segmentStart !== routePrefix.length) {
+    tokens.push(routePrefix.slice(segmentStart))
+  }
+
+  return tokens
+}
+
+/**
+ * @param {string} pathname
+ * @param {number} pathnameEnd
+ * @param {Array<string|undefined>} tokens
+ * @returns {number|undefined}
+ */
+function getRoutePrefixMatchLength (pathname, pathnameEnd, tokens) {
+  let pathnameIndex = 0
+
+  for (const token of tokens) {
+    if (token === undefined) {
+      const segmentStart = pathnameIndex
+      const slashIndex = pathname.indexOf('/', pathnameIndex)
+
+      pathnameIndex = slashIndex === -1 || slashIndex > pathnameEnd
+        ? pathnameEnd
+        : slashIndex
+
+      if (pathnameIndex === segmentStart) {
+        return
+      }
+
+      continue
+    }
+
+    const tokenEnd = pathnameIndex + token.length
+    if (tokenEnd > pathnameEnd || !pathname.startsWith(token, pathnameIndex)) {
+      return
+    }
+
+    pathnameIndex = tokenEnd
+  }
+
+  return pathnameIndex
+}
+
+/**
+ * @param {string} route
+ * @returns {(pathname: string, pathnameEnd: number) => number|undefined}
+ */
+function createRoutePrefixMatcher (route) {
+  const routePrefix = route.replace(/\*$/u, '')
+  const routePrefixLength = routePrefix.length
+
+  if (routePrefix === '/') {
+    return () => 0
+  }
+
+  if (routePrefix.includes(':') === false) {
+    return (pathname, pathnameEnd) => routePrefixLength <= pathnameEnd && pathname.startsWith(routePrefix)
+      ? routePrefixLength
+      : undefined
+  }
+
+  const tokens = createRoutePrefixTokens(routePrefix)
+  return (pathname, pathnameEnd) => getRoutePrefixMatchLength(pathname, pathnameEnd, tokens)
+}
+
+/**
+ * @param {string} url
+ * @param {(pathname: string, pathnameEnd: number) => number|undefined} matchRoutePrefix
+ * @returns {string|undefined}
+ */
+function getPathnameForSend (url, matchRoutePrefix) {
+  const questionMark = url.indexOf('?')
+  const pathnameEnd = questionMark === -1 ? url.length : questionMark
+
+  const prefixLength = matchRoutePrefix(url, pathnameEnd)
+  if (prefixLength === undefined) {
+    return
+  }
+
+  let pathname = url.slice(prefixLength, pathnameEnd)
+
+  if (pathname === '') {
+    pathname = '/'
+  } else if (!pathname.startsWith('/')) {
+    pathname = '/' + pathname
+  }
+
+  try {
+    return decodeURI(pathname)
+  } catch {
+
+  }
+}
+
 /**
  * @param {string} url
  * @return {string}

package/node_modules/@fastify/static/lib/dirList.js

@@ -6,6 +6,16 @@ const fs = require('node:fs/promises')
 const fastq = require('fastq')
 const fastqConcurrency = Math.max(1, os.cpus().length - 1)
 
+function isPathInsideRoot (root, target) {
+  const relativePath = path.relative(root, target)
+
+  return relativePath === '' || (
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relativePath)
+  )
+}
+
 const dirList = {
   _getExtendedInfo: async function (dir, info) {
     const depth = dir.split(path.sep).length
@@ -146,10 +156,10 @@ const dirList = {
    */
   htmlInfo: function (entry, route, prefix, options) {
     if (options.names?.includes(path.basename(route))) {
-      route = path.normalize(path.join(route, '..'))
+      route = path.posix.normalize(path.posix.join(route, '..'))
     }
     return {
-      href: encodeURI(path.join(prefix, route, entry.name).replace(/\\/gu, '/')),
+      href: encodeURI(path.posix.join(prefix, route, entry.name)),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo
@@ -172,12 +182,16 @@ const dirList = {
    * get path from route and fs root paths, considering trailing slash
    * @param {string} root fs root path
    * @param {string} route request route
+   * @return {string|null}
    */
   path: function (root, route) {
-    const _route = route[route.length - 1] === '/'
-      ? route + 'none'
-      : route
-    return path.dirname(path.join(root, _route))
+    const relativeRoute = route[route.length - 1] === '/'
+      ? '.' + route + 'none'
+      : '.' + route
+    const resolvedRoot = path.resolve(root)
+    const dir = path.dirname(path.resolve(resolvedRoot, relativeRoute))
+
+    return isPathInsideRoot(resolvedRoot, dir) ? dir : null
   },
 
   /**

package/node_modules/@fastify/static/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/static",
-  "version": "8.3.0",
+  "version": "9.1.3",
   "description": "Plugin for serving static files as fast as possible.",
   "main": "index.js",
   "type": "commonjs",
@@ -12,7 +12,8 @@
     "test": "npm run test:unit && npm run test:typescript",
     "test:typescript": "tsd",
     "test:unit": "borp -C --check-coverage --lines 100",
-    "example": "node example/server.js"
+    "example": "node example/server.js",
+    "example:benchmark": "node example/server-benchmark.js"
   },
   "repository": {
     "type": "git",
@@ -60,21 +61,22 @@
   "dependencies": {
     "@fastify/accept-negotiator": "^2.0.0",
     "@fastify/send": "^4.0.0",
-    "content-disposition": "^0.5.4",
+    "content-disposition": "^1.0.1",
     "fastify-plugin": "^5.0.0",
     "fastq": "^1.17.1",
-    "glob": "^11.0.0"
+    "glob": "^13.0.0"
   },
   "devDependencies": {
     "@fastify/compress": "^8.0.0",
-    "@types/node": "^24.0.13",
-    "borp": "^0.20.0",
-    "c8": "^10.1.3",
+    "@types/node": "^25.0.3",
+    "autocannon": "^8.0.0",
+    "borp": "^1.0.0",
+    "c8": "^11.0.0",
     "concat-stream": "^2.0.0",
     "eslint": "^9.17.0",
     "fastify": "^5.1.0",
     "neostandard": "^0.12.0",
-    "pino": "^9.1.0",
+    "pino": "^10.0.0",
     "proxyquire": "^2.1.3",
     "tsd": "^0.33.0"
   },

package/node_modules/@fastify/static/test/dir-list.test.js

@@ -3,6 +3,7 @@
 /* eslint n/no-deprecated-api: "off" */
 
 const fs = require('node:fs')
+const http = require('node:http')
 const path = require('node:path')
 const { test } = require('node:test')
 const Fastify = require('fastify')
@@ -18,6 +19,31 @@ const helper = {
     await fastify.listen({ port: 0 })
     fastify.server.unref()
     await f('http://localhost:' + fastify.server.address().port)
+  },
+  rawRequest: async function (baseUrl, route) {
+    const url = new URL(baseUrl)
+
+    return await new Promise((resolve, reject) => {
+      const request = http.request({
+        hostname: url.hostname,
+        port: url.port,
+        path: route,
+        method: 'GET'
+      }, (response) => {
+        let body = ''
+        response.setEncoding('utf8')
+        response.on('data', chunk => { body += chunk })
+        response.on('end', () => {
+          resolve({
+            statusCode: response.statusCode,
+            body
+          })
+        })
+      })
+
+      request.on('error', reject)
+      request.end()
+    })
   }
 }
 
@@ -65,6 +91,16 @@ test('throws when `list.format` is html and `list render` is not a function', t
   t.assert.deepStrictEqual(err.message, 'The `list.render` option must be a function and is required with html format')
 })
 
+test('dir list path stays within the configured root', t => {
+  t.plan(3)
+
+  const root = path.join(__dirname, '/static')
+
+  t.assert.deepStrictEqual(dirList.path(root, '/'), root)
+  t.assert.deepStrictEqual(dirList.path(root, '/deep/path/'), path.join(root, 'deep/path'))
+  t.assert.deepStrictEqual(dirList.path(root, '/../'), null)
+})
+
 test('dir list wrong options', async t => {
   t.plan(3)
 
@@ -181,6 +217,52 @@ test('dir list, custom options with empty array index', async t => {
   })
 })
 
+test('dir list blocks path traversal when index is false', async t => {
+  t.plan(2)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: false,
+    list: true
+  }
+  const routes = ['/public/../', '/public/../static2/']
+
+  await helper.arrange(t, options, async (url) => {
+    for (const route of routes) {
+      await t.test(route, async t => {
+        t.plan(2)
+
+        const response = await helper.rawRequest(url, route)
+        t.assert.deepStrictEqual(response.statusCode, 403)
+        t.assert.match(response.body, /Forbidden/u)
+      })
+    }
+  })
+})
+
+test('dir list blocks path traversal when index is an empty array', async t => {
+  t.plan(1)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: [],
+    list: true
+  }
+  const route = '/public/../'
+
+  await helper.arrange(t, options, async (url) => {
+    await t.test(route, async t => {
+      t.plan(2)
+
+      const response = await helper.rawRequest(url, route)
+      t.assert.deepStrictEqual(response.statusCode, 403)
+      t.assert.match(response.body, /Forbidden/u)
+    })
+  })
+})
+
 test('dir list html format', async t => {
   t.plan(2)