st 3.0.0 → 3.0.2

package/.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: Test
+on: [push, pull_request]
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [lts/*, current]
+        os: [macos-latest, ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install Dependencies
+        run: |
+          npm install --no-progress
+      - name: Run tests
+        run: |
+          npm test

package/bin/server.js

@@ -82,6 +82,7 @@ for (let i = 2; i < process.argv.length; i++) {
     case '--help':
       help()
       process.exit(0)
+      break
 
     case '-nc':
     case '--no-cache':
@@ -150,9 +151,9 @@ if (isNaN(port)) {
 
 const opt = {
   path: dir,
-  url: url,
-  index: index,
-  dot: dot,
+  url,
+  index,
+  dot,
   cache: {
     fd: {},
     stat: {},
@@ -160,7 +161,7 @@ const opt = {
     readdir: {},
     content: {}
   },
-  cors: cors
+  cors
 }
 
 if (cache === false) {

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "st",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "A module for serving static files.  Does etags, caching, etc.",
   "main": "st.js",
   "bin": "bin/server.js",
   "dependencies": {
     "async-cache": "^1.1.0",
-    "bl": "^5.0.0",
-    "fd": "~0.0.3",
-    "mime": "^2.5.2",
-    "negotiator": "~0.6.2"
+    "bl": "^6.1.0",
+    "fd": "^0.0.3",
+    "mime": "^3.0.0",
+    "negotiator": "^1.0.0"
   },
   "optionalDependencies": {
     "graceful-fs": "^4.2.3"
@@ -17,8 +17,8 @@
   "devDependencies": {
     "request": "^2.88.2",
     "rimraf": "^3.0.2",
-    "standard": "^16.0.3",
-    "tap": "^15.0.9"
+    "standard": "^17.1.2",
+    "tap": "^15.2.3"
   },
   "scripts": {
     "lint": "standard",

package/st.js

@@ -1,6 +1,5 @@
 const mime = require('mime')
 const path = require('path')
-const url = require('url')
 let fs
 try {
   fs = require('graceful-fs')
@@ -180,22 +179,13 @@ class Mount {
 
   // get the path component from a URI
   getUriPath (u) {
-    let p = url.parse(u).pathname // eslint-disable-line
+    let p = new URL(u, 'http://base').pathname
 
-    // Encoded dots are dots
-    p = p.replace(/%2e/ig, '.')
+    // Convert any backslashes to forward slashes (for consistency)
+    p = p.replace(/\\/g, '/')
 
-    // encoded slashes are /
-    p = p.replace(/%2f|%5c/ig, '/')
-
-    // back slashes are slashes
-    p = p.replace(/[/\\]/g, '/')
-
-    // Make sure it starts with a slash
-    p = p.replace(/^\//, '/')
+    // Remove the redundant leading slash replacement - URL().pathname always starts with /
     if ((/[/\\]\.\.([/\\]|$)/).test(p)) {
-      // traversal urls not ever even slightly allowed. clearly shenanigans
-      // send a 403 on that noise, do not pass go, do not collect $200
       return 403
     }
 
@@ -204,15 +194,18 @@ class Mount {
       return false
     }
 
+    // URL constructor already decoded, but we might need additional decoding
+    // for edge cases. Only do it if it would actually change something.
     try {
-      u = decodeURIComponent(u)
+      const decoded = decodeURIComponent(u)
+      if (decoded !== u) {
+        u = decoded
+      }
     } catch (e) {
-      // if decodeURIComponent failed, we weren't given a valid URL to begin with.
+    // if decodeURIComponent failed, we weren't given a valid URL to begin with.
       return false
     }
 
-    // /a/b/c mounted on /path/to/z/d/x
-    // /a/b/c/d --> /path/to/z/d/x/d
     u = u.substr(this.url.length)
     if (u.charAt(0) !== '/') {
       u = '/' + u
@@ -223,7 +216,10 @@ class Mount {
 
   // get a path from a url
   getPath (u) {
-    return path.join(this.path, u)
+    // trailing slash removal to fix Node.js v23 bug
+    // https://github.com/nodejs/node/pull/55527
+    // can be removed when this is resolved and released
+    return path.join(this.path, u.replace(/\/+$/, ''))
   }
 
   // get a url from a path
@@ -442,7 +438,7 @@ class Mount {
   }
 
   streamFile (p, fd, stat, etag, req, res, end) {
-    const streamOpt = { fd: fd, start: 0, end: stat.size }
+    const streamOpt = { fd, start: 0, end: stat.size }
     let stream = fs.createReadStream(p, streamOpt)
     stream.destroy = () => {}
 
@@ -454,7 +450,7 @@ class Mount {
 
     // need a gzipped version for the cache, so do it regardless of what the client wants
     if (gz || (gzOpt && cachable)) {
-      gzstr = zlib.Gzip()
+      gzstr = zlib.createGzip()
     }
 
     // too late to effectively handle any errors.

package/test/basic.js

@@ -97,6 +97,14 @@ test('multiball!', (t) => {
   }
 })
 
+test('trailing slash', (t) => {
+  req('/test/test/fixtures/', (er, res, body) => {
+    t.equal(res.statusCode, 200)
+    t.ok(/<html>.*Index of \/test\/fixtures<[\s\S]+index\.html[\s\S]+space in filename\.txt[\s\S]+<\/html>/.test(body.toString()))
+    t.end()
+  })
+})
+
 test('space in filename', (t) => {
   req('/test/test/fixtures/space in filename.txt', (er, res, body) => {
     t.equal(res.statusCode, 200)
@@ -117,17 +125,8 @@ test('shenanigans', (t) => {
     if (er) {
       throw er
     }
-    t.equal(res.statusCode, 403)
-    t.end()
-  })
-})
-
-test('shenanigans2', (t) => {
-  req('/test//foo/%2e%2E', (er, res) => {
-    if (er) {
-      throw er
-    }
-    t.equal(res.statusCode, 403)
+    // resolves to simply ./etc/passwd
+    t.equal(res.statusCode, 404)
     t.end()
   })
 })

package/test/cli/common.js

@@ -91,8 +91,8 @@ function serve (args, cbRequests, cbDone) {
     ++thingsToDo
     request({
       encoding: null,
-      url: url,
-      headers: headers
+      url,
+      headers
     }, (...args) => {
       try {
         cb.apply(null, args)

package/test/cli/host-test.js

@@ -1,4 +1,5 @@
 const os = require('os')
+const dns = require('dns')
 let { test, fail, comment } = require('tap')
 const { serve } = require('./common')
 const port = 1338
@@ -73,12 +74,6 @@ testServer(
   ['127.0.0.1', 'localhost', otherAddress], []
 )
 
-testServer(
-  'Restricted to localhost',
-  ['--localhost'], 'localhost',
-  ['127.0.0.1', 'localhost'], [otherAddress]
-)
-
 testServer(
   'Restricted to non-local host',
   ['--host', otherAddress], otherAddress,
@@ -90,3 +85,14 @@ testServer(
   ['--host', '127.0.0.1'], '127.0.0.1',
   ['127.0.0.1'], ['::1']
 )
+
+dns.lookup('localhost', (err, address) => {
+  if (err) {
+    throw err
+  }
+  testServer(
+    'Restricted to localhost',
+    ['--localhost'], 'localhost',
+    [address, 'localhost'], [otherAddress]
+  )
+})

package/test/common.js

@@ -32,7 +32,7 @@ function req (url, headers, cb) {
   request({
     encoding: null,
     url: `http://${host}:${address.port}${url}`,
-    headers: headers,
+    headers,
     followRedirect: false
   }, cb)
 }

package/test/gzip-after-no-gzip.js

@@ -12,7 +12,10 @@ test('does not gzip first response', (t) => {
     t.notOk(res.headers['content-encoding'])
     t.notOk(res.headers['x-from-cache'])
     t.equal(body.toString(), stExpect)
-    t.end()
+    // response is delivered before cache is set, so we'll give it a tiny bit
+    // of grace to close out on the server side before starting the next
+    // test
+    setTimeout(t.end, 100)
   })
 })
 

package/test/multi-mount.js

@@ -47,13 +47,13 @@ function req (url, headers, cb) {
   request({
     encoding: null,
     url: `http://localhost:${port}${url}`,
-    headers: headers,
+    headers,
     agentOptions: { maxSockets: 50 }
   }, next)
   request({
     encoding: null,
     url: `http://localhost:${(port + 1)}${url}`,
-    headers: headers,
+    headers,
     agentOptions: { maxSockets: 50 }
   }, next)
 
@@ -76,7 +76,7 @@ function req (url, headers, cb) {
       assert.strictEqual(`${body}`, `${prev.body}`)
       return cb(er, res, body)
     }
-    prev = { res: res, body: body }
+    prev = { res, body }
   }
 }
 
@@ -90,7 +90,7 @@ test('setup middleware server', function (t) {
       })
     })
   })
-  middlewareServer.listen(port, '127.0.0.1', function () {
+  middlewareServer.listen(port, 'localhost', function () {
     t.pass('listening')
     t.end()
   })
@@ -103,7 +103,7 @@ test('setup regular server', function (t) {
       return res.end(`Not a match: ${req.url}`)
     }
   })
-  server.listen(port + 1, '127.0.0.1', function () {
+  server.listen(port + 1, 'localhost', function () {
     t.pass('listening')
     t.end()
   })
@@ -114,6 +114,7 @@ const stExpect = fs.readFileSync(require.resolve('../st.js')).toString()
 
 test('/test/st.js', function (t) {
   req('/test/st.js', function (er, res, body) {
+    t.error(er)
     t.equal(res.statusCode, 200)
     t.ok(res.headers.etag)
     stEtag = res.headers.etag

package/test/preset-cache-control.js

@@ -23,7 +23,7 @@ function req (url, headers, cb) {
   request({
     encoding: null,
     url: 'http://localhost:' + port + url,
-    headers: headers
+    headers
   }, cb)
 }