Skip to content

feat(serve-static): support absolute root #3420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yusukebe merged 8 commits into from
Sep 24, 2024
Merged

feat(serve-static): support absolute root #3420

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9e761e2
feat(serve-static): support absolute root
yusukebe Sep 17, 2024
46346a4
add bun runtime test
yusukebe Sep 17, 2024
5d7a2af
don't use `Request`
yusukebe Sep 17, 2024
2835570
add code for deno
yusukebe Sep 20, 2024
a93839a
remove unnecessay `console.log`
yusukebe Sep 21, 2024
5f07dd7
use `normalizeFilePath` instead of `URL`
yusukebe Sep 21, 2024
5dd59c5
use `URL` for `options.root`
yusukebe Sep 21, 2024
6365ba9
don't allow directory traversal and fix the behavior when root includ…
yusukebe Sep 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions runtime-tests/bun/index.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
import fs from 'fs/promises'
import path from 'path'
import { stream, streamSSE } from '../..//src/helper/streaming'
import { serveStatic, toSSG } from '../../src/adapter/bun'
import { createBunWebSocket } from '../../src/adapter/bun/websocket'
Expand Down Expand Up @@ -42,7 +44,7 @@ describe('Basic', () => {

describe('Environment Variables', () => {
it('Should return the environment variable', async () => {
const c = new Context(new HonoRequest(new Request('http://localhost/')))
const c = new Context(new Request('http://localhost/'))
const { NAME } = env<{ NAME: string }>(c)
expect(NAME).toBe('Bun')
})
Expand Down Expand Up @@ -107,6 +109,11 @@ describe('Serve Static Middleware', () => {
})
)

app.all(
'/static-absolute-root/*',
serveStatic({ root: path.dirname(__filename), allowAbsoluteRoot: true })
)

beforeEach(() => onNotFound.mockClear())

it('Should return static file correctly', async () => {
Expand Down Expand Up @@ -157,6 +164,13 @@ describe('Serve Static Middleware', () => {
expect(res.status).toBe(200)
expect(await res.text()).toBe('Hi\n')
})

it('Should return 200 response - /static-absolute-root/plain.txt', async () => {
const res = await app.request('http://localhost/static-absolute-root/plain.txt')
expect(res.status).toBe(200)
expect(await res.text()).toBe('Bun!')
expect(onNotFound).not.toHaveBeenCalled()
})
})

// Bun support WebCrypto since v0.2.2
Expand Down Expand Up @@ -310,8 +324,6 @@ describe('WebSockets Helper', () => {
expect(receivedMessage).toBe(message)
})
})
const fs = require('fs').promises
const path = require('path')

async function deleteDirectory(dirPath) {
if (
Expand Down
1 change: 1 addition & 0 deletions runtime-tests/bun/static-absolute-root/plain.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Bun!
2 changes: 1 addition & 1 deletion runtime-tests/deno/.vscode/settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"eslint.validate": ["javascript", "javascriptreact", "typescript", "typescriptreact"],
"editor.codeActionsOnSave": {
"source.fixAll.eslint": true
"source.fixAll.eslint": "explicit"
},
"deno.enable": true
}
3 changes: 2 additions & 1 deletion runtime-tests/deno/deno.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,8 @@
],
"imports": {
"@std/assert": "jsr:@std/assert@^1.0.3",
"@std/path": "jsr:@std/path@^1.0.3",
"@std/testing": "jsr:@std/testing@^1.0.1",
"hono/jsx/jsx-runtime": "../../src/jsx/jsx-runtime.ts"
}
}
}
26 changes: 24 additions & 2 deletions runtime-tests/deno/deno.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions runtime-tests/deno/middleware.test.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
import { assertEquals, assertMatch } from '@std/assert'
import { dirname, fromFileUrl } from '@std/path'
import { assertSpyCall, assertSpyCalls, spy } from '@std/testing/mock'
import { serveStatic } from '../../src/adapter/deno/index.ts'
import { Hono } from '../../src/hono.ts'
Expand Down Expand Up @@ -94,6 +95,21 @@ Deno.test('Serve Static middleware', async () => {
})
)

console.log(dirname(fromFileUrl(import.meta.url)))
Comment thread
yusukebe marked this conversation as resolved.
Outdated

app.get(
'/static-absolute-root/*',
serveStatic({ root: dirname(fromFileUrl(import.meta.url)), allowAbsoluteRoot: true })
)

app.get(
'/static/*',
serveStatic({
root: './runtime-tests/deno',
onNotFound,
})
)

let res = await app.request('http://localhost/favicon.ico')
assertEquals(res.status, 200)
assertEquals(res.headers.get('Content-Type'), 'image/x-icon')
Expand Down Expand Up @@ -132,6 +148,10 @@ Deno.test('Serve Static middleware', async () => {
res = await app.request('http://localhost/static/hello.world')
assertEquals(res.status, 200)
assertEquals(await res.text(), 'Hi\n')

res = await app.request('http://localhost/static-absolute-root/plain.txt')
assertEquals(res.status, 200)
assertEquals(await res.text(), 'Deno!')
})

Deno.test('JWT Authentication middleware', async () => {
Expand Down
1 change: 1 addition & 0 deletions runtime-tests/deno/static-absolute-root/plain.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Deno!
4 changes: 2 additions & 2 deletions src/adapter/bun/serve-static.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@ export const serveStatic = <E extends Env = Env>(
): MiddlewareHandler => {
return async function serveStatic(c, next) {
const getContent = async (path: string) => {
path = `./${path}`
path = path.startsWith('/') ? path : `./${path}`
// @ts-ignore
const file = Bun.file(path)
return (await file.exists()) ? file : null
}
const pathResolve = (path: string) => {
return `./${path}`
return path.startsWith('/') ? path : `./${path}`
}
const isDir = async (path: string) => {
let isDir
Expand Down
2 changes: 1 addition & 1 deletion src/adapter/deno/serve-static.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ export const serveStatic = <E extends Env = Env>(
}
}
const pathResolve = (path: string) => {
return `./${path}`
return path.startsWith('/') ? path : `./${path}`
}
const isDir = (path: string) => {
let isDir
Expand Down
5 changes: 5 additions & 0 deletions src/middleware/serve-static/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import { getMimeType } from '../../utils/mime'
export type ServeStaticOptions<E extends Env = Env> = {
root?: string
path?: string
allowAbsoluteRoot?: boolean
precompressed?: boolean
mimes?: Record<string, string>
rewriteRequestPath?: (path: string) => string
Expand Down Expand Up @@ -50,11 +51,14 @@ export const serveStatic = <E extends Env = Env>(
filename = options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename
const root = options.root

const allowAbsoluteRoot = options.allowAbsoluteRoot ?? false

// If it was Directory, force `/` on the end.
if (!filename.endsWith('/') && options.isDir) {
const path = getFilePathWithoutDefaultDocument({
filename,
root,
allowAbsoluteRoot,
})
if (path && (await options.isDir(path))) {
filename += '/'
Expand All @@ -64,6 +68,7 @@ export const serveStatic = <E extends Env = Env>(
let path = getFilePath({
filename,
root,
allowAbsoluteRoot,
defaultDocument: DEFAULT_DOCUMENT,
})

Expand Down
21 changes: 21 additions & 0 deletions src/utils/filepath.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,27 @@ describe('getFilePath', () => {
expect(getFilePath({ filename: 'filename.suffix_index' })).toBe('filename.suffix_index')
expect(getFilePath({ filename: 'filename.suffix-index' })).toBe('filename.suffix-index')
})

it('Should return file path correctly with allowAbsoluteRoot', async () => {
const allowAbsoluteRoot = true
expect(getFilePath({ filename: 'foo.txt', allowAbsoluteRoot })).toBe('/foo.txt')
expect(getFilePath({ filename: 'foo.txt', root: '/p', allowAbsoluteRoot })).toBe('/p/foo.txt')
expect(getFilePath({ filename: 'foo', root: '/p', allowAbsoluteRoot })).toBe(
'/p/foo/index.html'
)
expect(getFilePath({ filename: 'foo.txt', root: '/p/../p2', allowAbsoluteRoot })).toBe(
'/p2/foo.txt'
)
expect(getFilePath({ filename: 'foo', root: '/p/bar', allowAbsoluteRoot })).toBe(
'/p/bar/foo/index.html'
)
expect(
getFilePath({ filename: 'foo.txt', root: slashToBackslash('/p'), allowAbsoluteRoot })
).toBe('/p/foo.txt')
expect(
getFilePath({ filename: 'foo.txt', root: slashToBackslash('/p/../p2'), allowAbsoluteRoot })
).toBe('/p2/foo.txt')
})
})

function slashToBackslash(filename: string) {
Expand Down
16 changes: 15 additions & 1 deletion src/utils/filepath.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ type FilePathOptions = {
filename: string
root?: string
defaultDocument?: string
allowAbsoluteRoot?: boolean
}

export const getFilePath = (options: FilePathOptions): string | undefined => {
Expand All @@ -23,6 +24,7 @@ export const getFilePath = (options: FilePathOptions): string | undefined => {

const path = getFilePathWithoutDefaultDocument({
root: options.root,
allowAbsoluteRoot: options.allowAbsoluteRoot,
filename,
})

Expand All @@ -42,6 +44,9 @@ export const getFilePathWithoutDefaultDocument = (
// /foo.html => foo.html
filename = filename.replace(/^\.?[\/\\]/, '')

@usualoma usualoma Sep 20, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would be better to use /^\.?[\/\\]+/ because it is very dangerous if a / remains at the beginning due to the following changes.

https://github.com/honojs/hono/pull/3420/files#diff-ab73a967275a45e7a4ef6280ce16d384179d552efc1095f067f3a43706fb189eR12

Suggested change
filename = filename.replace(/^\.?[\/\\]/, '')
filename = filename.replace(/^\.?[\/\\]+/, '')

@yusukebe yusukebe Sep 21, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the following code one of the dangerous cases? You mean this test should pass, right?

// with the current implementation, the following will fail
expect(getFilePathWithoutDefaultDocument({ filename: '///foo.txt' })).toBe('foo.txt')

@usualoma usualoma Sep 21, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, I'm sorry, the code I suggested might not be good. The case I'm worried about is as follows.

import { serveStatic } from './src/adapter/bun'
import { Hono } from './src/hono'

const app = new Hono()

app.use('/static/*', serveStatic({ root: './' }))
app.use('/favicon.ico', serveStatic({ path: './favicon.ico' }))
app.get('/', (c) => c.text('You can access: /static/hello.txt'))
app.get('*', serveStatic({ root: '.' })) // fallback
// or app.get('*', serveStatic({}))

export default app

I don't think this is a realistic setting, but it's not an invalid setting, and I think the relative path from the application directory will result in the expected result. With the current code in the feat/serve-static-absolute-root branch, if you access http://localhost:3000///etc/passwd, you can access any path from the absolute path using directory traversal.

@usualoma usualoma Sep 21, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the following changes will also prevent directory traversal.

diff --git a/src/utils/filepath.ts b/src/utils/filepath.ts
index f3f2ea82..61471483 100644
--- a/src/utils/filepath.ts
+++ b/src/utils/filepath.ts
@@ -52,5 +52,9 @@ export const getFilePathWithoutDefaultDocument = (
   let path = root ? root + '/' + filename : filename
   path = path.replace(/^\.?\//, '')
 
+  if (root[0] !== '/' && path[0] === '/') {
+    return
+  }
+
   return path
 }


// assets\foo => assets/foo
root = root.replace(/\\/, '/')

// foo\bar.txt => foo/bar.txt
filename = filename.replace(/\\/, '/')

Expand All @@ -50,7 +55,16 @@ export const getFilePathWithoutDefaultDocument = (

// ./assets/foo.html => assets/foo.html
let path = root ? root + '/' + filename : filename
path = path.replace(/^\.?\//, '')

if (!options.allowAbsoluteRoot) {
path = path.replace(/^\.?\//, '')
} else {
// assets => /assets
path = path.replace(/^(?!\/)/, '/')
// Using URL to normalize the path.
const url = new URL(`file://${path}`)

@usualoma usualoma Sep 20, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What was the purpose of using URL? (Sorry, I don't understand.)

With the current code, the following results will be obtained, so I think some kind of modification is necessary.

getFilePathWithoutDefaultDocument({
  filename: '/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd',
  root: '/p/p2',
  allowAbsoluteRoot: true,
}) // /etc/passwd

@yusukebe yusukebe Sep 21, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It uses URL to normalize paths like .., but as you said, it's not good! I'll change it.

@yusukebe yusukebe Sep 21, 2024 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@usualoma

What about this change? 5f07dd7

@usualoma usualoma Sep 21, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

If the necessary requirements are as follows,

  • root : .. refers to the directory above
  • path: %2e%2e should be left as is

The following code would also achieve this, and I think it would be more performant than resolving .. for each request. Is it possible to meet the requirements in this way?

diff --git a/src/middleware/serve-static/index.ts b/src/middleware/serve-static/index.ts
index 49cbcd3c..3517a2e7 100644
--- a/src/middleware/serve-static/index.ts
+++ b/src/middleware/serve-static/index.ts
@@ -40,6 +40,8 @@ export const serveStatic = <E extends Env = Env>(
     isDir?: (path: string) => boolean | undefined | Promise<boolean | undefined>
   }
 ): MiddlewareHandler => {
+  const root = new URL(`file://${options.root}`).pathname
+
   return async (c, next) => {
     // Do nothing if Response is already set
     if (c.finalized) {
@@ -49,7 +51,6 @@ export const serveStatic = <E extends Env = Env>(
 
     let filename = options.path ?? decodeURI(c.req.path)
     filename = options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename
-    const root = options.root
 
     const allowAbsoluteRoot = options.allowAbsoluteRoot ?? false

@yusukebe yusukebe Sep 21, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahhhh, goood idea!

@yusukebe yusukebe Sep 21, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@usualoma

I updated it. What do you think of the middleware/serve-static/index.ts?

@usualoma usualoma Sep 21, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@usualoma usualoma Sep 21, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, but

new URL(`file://${options.root}`).pathname

I think the behavior will change if you specify a relative path that includes the parent directory.

serveStatic({ root: '../relative/from/parent' })

The following method may be better.

  let root: string = options.root

  if (root && root.startsWith('/')) {
    isAbsoluteRoot = true
    root = new URL(`file://${root}`).pathname
  }

@yusukebe yusukebe Sep 22, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@usualoma

I've updated the code: 6365ba9

This change includes the fix for #3420 (comment) and added some tests. Could you review it?

path = url.pathname
}

return path
}