st 3.0.1 → 3.0.2

package/bin/server.js

@@ -82,6 +82,7 @@ for (let i = 2; i < process.argv.length; i++) {
     case '--help':
       help()
       process.exit(0)
+      break
 
     case '-nc':
     case '--no-cache':
@@ -150,9 +151,9 @@ if (isNaN(port)) {
 
 const opt = {
   path: dir,
-  url: url,
-  index: index,
-  dot: dot,
+  url,
+  index,
+  dot,
   cache: {
     fd: {},
     stat: {},
@@ -160,7 +161,7 @@ const opt = {
     readdir: {},
     content: {}
   },
-  cors: cors
+  cors
 }
 
 if (cache === false) {

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "st",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "A module for serving static files.  Does etags, caching, etc.",
   "main": "st.js",
   "bin": "bin/server.js",
   "dependencies": {
     "async-cache": "^1.1.0",
-    "bl": "^5.0.0",
-    "fd": "~0.0.3",
-    "mime": "^2.5.2",
-    "negotiator": "~0.6.2"
+    "bl": "^6.1.0",
+    "fd": "^0.0.3",
+    "mime": "^3.0.0",
+    "negotiator": "^1.0.0"
   },
   "optionalDependencies": {
     "graceful-fs": "^4.2.3"
@@ -17,8 +17,8 @@
   "devDependencies": {
     "request": "^2.88.2",
     "rimraf": "^3.0.2",
-    "standard": "^16.0.3",
-    "tap": "^15.0.9"
+    "standard": "^17.1.2",
+    "tap": "^15.2.3"
   },
   "scripts": {
     "lint": "standard",

package/st.js

@@ -1,6 +1,5 @@
 const mime = require('mime')
 const path = require('path')
-const url = require('url')
 let fs
 try {
   fs = require('graceful-fs')
@@ -180,22 +179,13 @@ class Mount {
 
   // get the path component from a URI
   getUriPath (u) {
-    let p = url.parse(u).pathname // eslint-disable-line
+    let p = new URL(u, 'http://base').pathname
 
-    // Encoded dots are dots
-    p = p.replace(/%2e/ig, '.')
+    // Convert any backslashes to forward slashes (for consistency)
+    p = p.replace(/\\/g, '/')
 
-    // encoded slashes are /
-    p = p.replace(/%2f|%5c/ig, '/')
-
-    // back slashes are slashes
-    p = p.replace(/[/\\]/g, '/')
-
-    // Make sure it starts with a slash
-    p = p.replace(/^\//, '/')
+    // Remove the redundant leading slash replacement - URL().pathname always starts with /
     if ((/[/\\]\.\.([/\\]|$)/).test(p)) {
-      // traversal urls not ever even slightly allowed. clearly shenanigans
-      // send a 403 on that noise, do not pass go, do not collect $200
       return 403
     }
 
@@ -204,15 +194,18 @@ class Mount {
       return false
     }
 
+    // URL constructor already decoded, but we might need additional decoding
+    // for edge cases. Only do it if it would actually change something.
     try {
-      u = decodeURIComponent(u)
+      const decoded = decodeURIComponent(u)
+      if (decoded !== u) {
+        u = decoded
+      }
     } catch (e) {
-      // if decodeURIComponent failed, we weren't given a valid URL to begin with.
+    // if decodeURIComponent failed, we weren't given a valid URL to begin with.
       return false
     }
 
-    // /a/b/c mounted on /path/to/z/d/x
-    // /a/b/c/d --> /path/to/z/d/x/d
     u = u.substr(this.url.length)
     if (u.charAt(0) !== '/') {
       u = '/' + u
@@ -445,7 +438,7 @@ class Mount {
   }
 
   streamFile (p, fd, stat, etag, req, res, end) {
-    const streamOpt = { fd: fd, start: 0, end: stat.size }
+    const streamOpt = { fd, start: 0, end: stat.size }
     let stream = fs.createReadStream(p, streamOpt)
     stream.destroy = () => {}
 
@@ -457,7 +450,7 @@ class Mount {
 
     // need a gzipped version for the cache, so do it regardless of what the client wants
     if (gz || (gzOpt && cachable)) {
-      gzstr = zlib.Gzip()
+      gzstr = zlib.createGzip()
     }
 
     // too late to effectively handle any errors.

package/test/basic.js

@@ -125,17 +125,8 @@ test('shenanigans', (t) => {
     if (er) {
       throw er
     }
-    t.equal(res.statusCode, 403)
-    t.end()
-  })
-})
-
-test('shenanigans2', (t) => {
-  req('/test//foo/%2e%2E', (er, res) => {
-    if (er) {
-      throw er
-    }
-    t.equal(res.statusCode, 403)
+    // resolves to simply ./etc/passwd
+    t.equal(res.statusCode, 404)
     t.end()
   })
 })

package/test/cli/common.js

@@ -91,8 +91,8 @@ function serve (args, cbRequests, cbDone) {
     ++thingsToDo
     request({
       encoding: null,
-      url: url,
-      headers: headers
+      url,
+      headers
     }, (...args) => {
       try {
         cb.apply(null, args)

package/test/common.js

@@ -32,7 +32,7 @@ function req (url, headers, cb) {
   request({
     encoding: null,
     url: `http://${host}:${address.port}${url}`,
-    headers: headers,
+    headers,
     followRedirect: false
   }, cb)
 }

package/test/gzip-after-no-gzip.js

@@ -12,7 +12,10 @@ test('does not gzip first response', (t) => {
     t.notOk(res.headers['content-encoding'])
     t.notOk(res.headers['x-from-cache'])
     t.equal(body.toString(), stExpect)
-    t.end()
+    // response is delivered before cache is set, so we'll give it a tiny bit
+    // of grace to close out on the server side before starting the next
+    // test
+    setTimeout(t.end, 100)
   })
 })
 

package/test/multi-mount.js

@@ -47,13 +47,13 @@ function req (url, headers, cb) {
   request({
     encoding: null,
     url: `http://localhost:${port}${url}`,
-    headers: headers,
+    headers,
     agentOptions: { maxSockets: 50 }
   }, next)
   request({
     encoding: null,
     url: `http://localhost:${(port + 1)}${url}`,
-    headers: headers,
+    headers,
     agentOptions: { maxSockets: 50 }
   }, next)
 
@@ -76,7 +76,7 @@ function req (url, headers, cb) {
       assert.strictEqual(`${body}`, `${prev.body}`)
       return cb(er, res, body)
     }
-    prev = { res: res, body: body }
+    prev = { res, body }
   }
 }
 

package/test/preset-cache-control.js

@@ -23,7 +23,7 @@ function req (url, headers, cb) {
   request({
     encoding: null,
     url: 'http://localhost:' + port + url,
-    headers: headers
+    headers
   }, cb)
 }