Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(static): avoid user-provided data in Error messages being interpreted as sprintf codes #1384

Merged
merged 3 commits into from Jun 28, 2017
Merged

fix(static): avoid user-provided data in Error messages being interpreted as sprintf codes #1384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
475142d
'static' plugin: avoid user-provided data in Error messages being int…
trentm Jun 26, 2017
492416e
drop ver bump changes, per review comments
trentm Jun 27, 2017
5ee1008
update test name and drop comment (unnecessary with issue ref) per re…
trentm Jun 27, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 2 additions & 1 deletion CHANGES.md
View file
Open in desktop
Expand Up @@ -2,7 +2,8 @@

## not yet released

(nothing yet)
- #1382 Fix "static" plugin to not throw on a 404 for a path with sprintf-like
percent escape codes.

## 4.3.0

Expand Down
9 changes: 4 additions & 5 deletions lib/plugins/static.js
View file
Open in desktop
Expand Up @@ -44,8 +44,7 @@ function serveStatic(opts) {

function serveFileFromStats(file, err, stats, isGzip, req, res, next) {
if (err) {
next(new ResourceNotFoundError(err,
req.path()));
next(new ResourceNotFoundError(err, '%s', req.path()));
return;
} else if (!stats.isFile()) {
next(new ResourceNotFoundError('%s does not exist', req.path()));
Expand Down Expand Up @@ -120,17 +119,17 @@ function serveStatic(opts) {
}

if (req.method !== 'GET' && req.method !== 'HEAD') {
next(new MethodNotAllowedError(req.method));
next(new MethodNotAllowedError('%s', req.method));
return;
}

if (!re.test(file.replace(/\\/g, '/'))) {
next(new NotAuthorizedError(req.path()));
next(new NotAuthorizedError('%s', req.path()));
return;
}

if (opts.match && !opts.match.test(file)) {
next(new NotAuthorizedError(req.path()));
next(new NotAuthorizedError('%s', req.path()));
return;
}

Expand Down
31 changes: 31 additions & 0 deletions test/plugins.test.js
View file
Open in desktop
Expand Up @@ -984,6 +984,37 @@ test('GH-719 serve a specific static file', function (t) {
serveStaticTest(t, false, '.tmp', null, true);
});

test('static responds 404 for missing file', function (t) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, this test was missing

var p = '/public/no-such-file.json';
var tmpPath = path.join(process.cwd(), '.tmp');

SERVER.get(new RegExp('/public/.*'),
restify.serveStatic({directory: tmpPath}));

CLIENT.get(p, function (err, req, res, obj) {
t.ok(err);
t.equal(err.statusCode, 404);
t.equal(err.restCode, 'ResourceNotFound');
t.end();
});
});

test('GH-1382 static responds 404 for missing file with percent-codes',
function (t) {
var p = '/public/no-%22such-file.json';
var tmpPath = path.join(process.cwd(), '.tmp');

SERVER.get(new RegExp('/public/.*'),
restify.serveStatic({directory: tmpPath}));

CLIENT.get(p, function (err, req, res, obj) {
t.ok(err);
t.equal(err.statusCode, 404);
t.equal(err.restCode, 'ResourceNotFound');
t.end();
});
});


test('audit logger timer test', function (t) {
// Dirty hack to capture the log record using a ring buffer.
Expand Down