Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replaced FileNotFoundException with log instead (#199) #200

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

LennardF1989
Copy link

@LennardF1989 LennardF1989 commented Dec 19, 2023

Fixes #199.

  • I added a logger on all applicable places in support of the reported issue.
  • Updated the unit test to check for a useful log-attempt instead of throwing an exception.
  • Tested the implemention using Smidge.Web both with and without AddSmidgeInMemory and manipulating some of the generated /sc-URLs:
    image

Upon testing, it looks like /sb-URLs could use a similar treatment as it will throw an exception when the bundle-key or version is invalid, but I'd say that's something for another PR.

EDIT: PS. I removed a myget-reference that is no longer valid and prevents restoring packages.

@@ -42,7 +47,7 @@ public IFileInfo GetRequiredFileInfo(string filePath)

if (!fileInfo.Exists)
{
throw new FileNotFoundException($"No such file exists {fileInfo.PhysicalPath ?? fileInfo.Name} (mapped from {filePath})", fileInfo.PhysicalPath ?? fileInfo.Name);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this should be handled differently, now fileInfo is returned even when its useless (also in MemoryCacheFileSystem).

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which is as intended, as other parts of the logic will check for .Exists, which is precisely what a FileInfo is for (a cheap wrapper to tell you if a file exists before attempting to open it). You also annotated the old code :)

Returning null here would mean a lot more code has to be touched and double-checked.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which is as intended, as other parts of the logic will check for .Exists, which is precisely what a FileInfo is for (a cheap wrapper to tell you if a file exists before attempting to open it). You also annotated the old code :)

Returning null here would mean a lot more code has to be touched and double-checked.

It's already documented that GetRequiredFileInfo throws:

/// Throws an exception if the file doesn't exist

So this would be breaking anyway.

Not all other paths check if the file exists (only SmidgeController does):

var sourceFile = new Lazy<IFileInfo>(() => _fileSystem.GetRequiredFileInfo(file), LazyThreadSafetyMode.None);

var filePath = _fileSystem.GetRequiredFileInfo(path);

This would also apply to other people using the library, now it doesn't throw anymore and you need to handle it differently.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remark about breaking change is fair, the other ones are easily "fixed" by reintroducing the exception right after retrieving the IFileInfo. I will push that in a second.

The two locations you pointed out are literally the only 2 places where something is done with GetRequiredFileInfo. They are also only called in very specific situations: @import in CSS and during bundle creation, both of which cannot be directly manipulated by malicious users (only malicious developers :P). That said, bundle creation would also need some love as I pointed out, but for another PR.

Copy link
Contributor

@PhyxionNL PhyxionNL Dec 19, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remark about breaking change is fair, the other ones are easily "fixed" by reintroducing the exception right after retrieving the IFileInfo.

Not everyone uses Smidge as-is, some have custom implementations around it. I don't mind fixing this at all, but let's try to get consistent behavior ☺️

I think it's fine not to throw anymore; then PreProcessManager can bail out, and CssImportProcessor can continue with the others.

Alternatively, SmidgeController could swallow the exception. This would be the least breaking change.
@Shazwazza what would you prefer?

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, i don't think we should change the behavior of this method since the meaning is in the name 'GetRequired...' ... which indicates that it will throw.

One way to be less breaking would be to have an optional overload of this like bool throwIfNotFound = true

It is a binary breaking change, but all folks nowadays build their projects before deploying so I don't think it would cause any issues.

Else I'm fine with try/catch/swallow where necessary

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LennardF1989 just wanted to ping on this one?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Honestly, I forgot that I did this xD I'll put it back on my list.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

GetCombinedStreamAsync > GetRequiredFileInfo exception should be handled gracefully to prevent DDoS
3 participants