Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/workflows/test.yml-template
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Test

on:
pull_request:
branches: [ master ]

jobs:
build:

runs-on: ubuntu-latest

strategy:
matrix:
node-version: [20.x]

steps:
- uses: actions/checkout@v2
- name: Use Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v1
with:
node-version: ${{ matrix.node-version }}
- run: npm install
- run: npm test
9 changes: 5 additions & 4 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
"devDependencies": {
"@faker-js/faker": "^8.4.1",
"@mate-academy/eslint-config": "latest",
"@mate-academy/scripts": "^1.8.6",
"@mate-academy/scripts": "^2.1.3",
"axios": "^1.7.2",
"eslint": "^8.57.0",
"eslint-plugin-jest": "^28.6.0",
Expand Down
43 changes: 41 additions & 2 deletions src/createServer.js
Original file line number Diff line number Diff line change
@@ -1,8 +1,47 @@
'use strict';

const http = require('http');
const fs = require('fs');

function createServer() {
/* Write your code here */
// Return instance of http.Server class
return http.createServer((req, res) => {
const normalizedUrl = new URL(req.url, `http://${req.headers.host}`);
const { pathname } = normalizedUrl;

if (pathname.includes('//')) {
res.writeHead(404, { 'Content-Type': 'text/plain' });
res.end('File Not Found');

return;
Comment on lines +11 to +15
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pathname.includes('//') check is not sufficient protection against crafted paths (e.g. .. segments). It's fine to keep as a simple sanity check, but do not rely on it for security — the path.resolve + path.relative containment check is required to guarantee no access outside public.

}

if (!pathname.startsWith('/file')) {
res.writeHead(400, { 'Content-Type': 'text/plain' });
res.end('Should be /file/*');

return;
Comment on lines +18 to +22
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This check !pathname.startsWith('/file') is too permissive: it treats /fileABC as a valid route. Instead accept exactly /file, /file/ or paths that start with /file/ (e.g. if (!(pathname === '/file' || pathname === '/file/' || pathname.startsWith('/file/')))). The spec requires the handler to detect when pathname does not start with /file/ and return a hint message.

}

const relativeFilePath = pathname.replace(/^\/file\/?/, '');

if (!relativeFilePath) {
res.writeHead(200, { 'Content-Type': 'text/plain' });
res.end('File Not Found');

return;
Comment on lines +27 to +31
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When relativeFilePath is empty (requests to /file or /file/) the handler returns 'File Not Found'. The spec requires /file and /file/ to return public/index.html. Change this branch to serve public/index.html (or default relativeFilePath to 'index.html' earlier) instead of returning this error.

}

fs.readFile(`public/${relativeFilePath}`, (err, data) => {
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reading public/${relativeFilePath} directly allows path traversal (for example /file/../secret). Import and use path to resolve and validate the filesystem path: compute publicDir = path.resolve(__dirname, '..', 'public'), resolvedPath = path.resolve(publicDir, relativeFilePath || 'index.html'), then verify containment using either const rel = path.relative(publicDir, resolvedPath) and return 404 when rel.startsWith('..') || path.isAbsolute(rel), or require resolvedPath === publicDir || resolvedPath.startsWith(publicDir + path.sep). Only then call fs.readFile(resolvedPath, ...). Also add const path = require('path') at the top.

if (err) {
res.writeHead(404, { 'Content-Type': 'text/plain' });
res.end('File Not Found');

return;
}
res.writeHead(200, { 'Content-Type': 'text/plain' });
res.end(data);
});
});
}

module.exports = {
Expand Down