-
Notifications
You must be signed in to change notification settings - Fork 401
added solution #360
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
added solution #360
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| name: Test | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: [ master ] | ||
|
|
||
| jobs: | ||
| build: | ||
|
|
||
| runs-on: ubuntu-latest | ||
|
|
||
| strategy: | ||
| matrix: | ||
| node-version: [20.x] | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 | ||
| - name: Use Node.js ${{ matrix.node-version }} | ||
| uses: actions/setup-node@v1 | ||
| with: | ||
| node-version: ${{ matrix.node-version }} | ||
| - run: npm install | ||
| - run: npm test |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,73 @@ | ||
| /* eslint-disable no-console */ | ||
| 'use strict'; | ||
|
|
||
| const http = require('http'); | ||
| const path = require('path'); | ||
| const fsp = require('fs/promises'); | ||
|
|
||
| function createServer() { | ||
| /* Write your code here */ | ||
| // Return instance of http.Server class | ||
| const server = http.createServer(async (req, res) => { | ||
| const MIME_TYPES = { | ||
| '.html': 'text/html', | ||
| '.css': 'text/css', | ||
| '.js': 'application/javascript', | ||
| '.json': 'application/json', | ||
| '.png': 'image/png', | ||
| '.jpg': 'image/jpeg', | ||
| '.svg': 'image/svg+xml', | ||
| }; | ||
|
|
||
| if (req.url.includes('//')) { | ||
| res.setHeader('Content-Type', 'text/plain'); | ||
| res.statusCode = 404; | ||
| res.end('Not Found'); | ||
|
|
||
| return; | ||
| } | ||
|
|
||
| const pathname = req.url.slice(1); | ||
|
|
||
| const [action, ...rest] = pathname.split('/'); | ||
| const fileName = rest.join('/'); | ||
|
|
||
| if (action !== 'file') { | ||
| res.setHeader('Content-Type', 'text/plain'); | ||
| res.statusCode = 400; | ||
|
|
||
| res.end('To load file, you need use "/file/fileName"'); | ||
|
|
||
| return; | ||
| } | ||
|
|
||
| if (!fileName) { | ||
| res.setHeader('Content-Type', 'text/plain'); | ||
| res.statusCode = 200; | ||
| res.end('To load file, you need use "/file/fileName"'); | ||
|
|
||
| return; | ||
| } | ||
|
Comment on lines
+42
to
+48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. According to the requirements, requests to
Comment on lines
+42
to
+48
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The requirements state that requests to |
||
|
|
||
| const realPath = path.join(__dirname, '..', 'public', fileName); | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This implementation is vulnerable to path traversal attacks. A request like There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The path traversal vulnerability mentioned in the previous review is still present. A malicious request like There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This implementation is still vulnerable to path traversal. A malicious request like |
||
|
|
||
| try { | ||
| const file = await fsp.readFile(realPath, 'utf-8'); | ||
|
|
||
| const ext = path.extname(fileName); | ||
| const contentType = MIME_TYPES[ext] || 'text/plain'; | ||
|
|
||
| res.setHeader('Content-Type', contentType); | ||
|
|
||
| res.statusCode = 200; | ||
| res.end(file); | ||
| } catch (error) { | ||
| res.setHeader('Content-Type', 'text/plain'); | ||
| res.statusCode = 404; | ||
|
|
||
| res.end('Not Found'); | ||
| } | ||
| }); | ||
|
|
||
| return server; | ||
| } | ||
|
|
||
| module.exports = { | ||
| createServer, | ||
| }; | ||
| module.exports = { createServer }; | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This conditional check is currently unreachable. The logic on line 22 (
|| 'index.html') ensures thatfileNamewill always be a non-empty string, so thisifblock will never execute. You can safely remove it.