static-server-beta

[Vlshedevr]

No description provided.

[mateacademy-ai-mentor]

Review Summary

While your server implementation is off to a good start, some changes are needed to address a couple of failing tests that were detected.

1. Path Traversal Vulnerability: The test should return 400 for traversal paths is failing. Your server isn't correctly blocking requests that use ../ to access files outside the public directory. Please add logic to validate the requested path and return a 400 Bad Request status when a traversal attempt is detected.
2. Incorrect Content-Type Header: For routes that do not start with /file/, the server should respond with a Content-Type of text/plain. The tests show it's currently sending text/html. You can fix this by explicitly setting the correct header before sending the response, for example: res.setHeader('Content-Type', 'text/plain');.

Addressing these two points will get your tests to pass. Keep up the great work!

---

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

Footnotes

1. Rate AI review example ↩

2. Re-request AI review example ↩

3. Add AI review comments example ↩

[mateacademy-ai-mentor]

Review Summary

Excellent work on the server implementation! You've correctly handled most of the routing and file-serving logic. However, changes are needed because a critical security test is failing. The server does not correctly block directory traversal attempts.

A request like /file/../app.js should be identified as a malicious attempt and rejected with a 400 Bad Request status code. Currently, your server is not returning this error, which creates a security vulnerability.

To fix this, you need to resolve the absolute path for the requested file and check if it is still within the public directory. If the resolved path points to a location outside of public, you should end the request and send the 400 status. You're very close to finishing!

---

✨ Please rate this review in the Platform's notification center¹. I will be grateful for your feedback! ✨

Important

Fix the issues, commit the changes, and then re-request my review using the Re-request review button² in the Reviewers tab.

Tip

If you have any comments about this review, please leave a message in the Add a comment section below and mention me with the @mateacademy-ai-mentor tag³.
I will read your message during my next review of your pull request. Please do not reply directly to my comments, as that feature is not supported yet.

Caution

Do not close the pull request until the review is complete. Closing it early can lead to unexpected behavior and disrupt the review process.

Footnotes

1. Rate AI review example ↩

2. Re-request AI review example ↩

3. Add AI review comments example ↩

[Anton-Kuchmasov]

Good job!