getFilenameFromUrl.js 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150
  1. "use strict";
  2. const path = require("path");
  3. const {
  4. parse
  5. } = require("url");
  6. const querystring = require("querystring");
  7. const getPaths = require("./getPaths");
  8. const memorize = require("./memorize");
  9. /** @typedef {import("../index.js").IncomingMessage} IncomingMessage */
  10. /** @typedef {import("../index.js").ServerResponse} ServerResponse */
  11. // eslint-disable-next-line no-undefined
  12. const memoizedParse = memorize(parse, undefined, value => {
  13. if (value.pathname) {
  14. // eslint-disable-next-line no-param-reassign
  15. value.pathname = decode(value.pathname);
  16. }
  17. return value;
  18. });
  19. const UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
  20. /**
  21. * @typedef {Object} Extra
  22. * @property {import("fs").Stats=} stats
  23. * @property {number=} errorCode
  24. * @property {boolean=} immutable
  25. */
  26. /**
  27. * decodeURIComponent.
  28. *
  29. * Allows V8 to only deoptimize this fn instead of all of send().
  30. *
  31. * @param {string} input
  32. * @returns {string}
  33. */
  34. function decode(input) {
  35. return querystring.unescape(input);
  36. }
  37. // TODO refactor me in the next major release, this function should return `{ filename, stats, error }`
  38. // TODO fix redirect logic when `/` at the end, like https://github.com/pillarjs/send/blob/master/index.js#L586
  39. /**
  40. * @template {IncomingMessage} Request
  41. * @template {ServerResponse} Response
  42. * @param {import("../index.js").FilledContext<Request, Response>} context
  43. * @param {string} url
  44. * @param {Extra=} extra
  45. * @returns {string | undefined}
  46. */
  47. function getFilenameFromUrl(context, url, extra = {}) {
  48. const {
  49. options
  50. } = context;
  51. const paths = getPaths(context);
  52. /** @type {string | undefined} */
  53. let foundFilename;
  54. /** @type {URL} */
  55. let urlObject;
  56. try {
  57. // The `url` property of the `request` is contains only `pathname`, `search` and `hash`
  58. urlObject = memoizedParse(url, false, true);
  59. } catch (_ignoreError) {
  60. return;
  61. }
  62. for (const {
  63. publicPath,
  64. outputPath,
  65. assetsInfo
  66. } of paths) {
  67. /** @type {string | undefined} */
  68. let filename;
  69. /** @type {URL} */
  70. let publicPathObject;
  71. try {
  72. publicPathObject = memoizedParse(publicPath !== "auto" && publicPath ? publicPath : "/", false, true);
  73. } catch (_ignoreError) {
  74. // eslint-disable-next-line no-continue
  75. continue;
  76. }
  77. const {
  78. pathname
  79. } = urlObject;
  80. const {
  81. pathname: publicPathPathname
  82. } = publicPathObject;
  83. if (pathname && pathname.startsWith(publicPathPathname)) {
  84. // Null byte(s)
  85. if (pathname.includes("\0")) {
  86. // eslint-disable-next-line no-param-reassign
  87. extra.errorCode = 400;
  88. return;
  89. }
  90. // ".." is malicious
  91. if (UP_PATH_REGEXP.test(path.normalize(`./${pathname}`))) {
  92. // eslint-disable-next-line no-param-reassign
  93. extra.errorCode = 403;
  94. return;
  95. }
  96. // Strip the `pathname` property from the `publicPath` option from the start of requested url
  97. // `/complex/foo.js` => `foo.js`
  98. // and add outputPath
  99. // `foo.js` => `/home/user/my-project/dist/foo.js`
  100. filename = path.join(outputPath, pathname.slice(publicPathPathname.length));
  101. try {
  102. // eslint-disable-next-line no-param-reassign
  103. extra.stats = context.outputFileSystem.statSync(filename);
  104. } catch (_ignoreError) {
  105. // eslint-disable-next-line no-continue
  106. continue;
  107. }
  108. if (extra.stats.isFile()) {
  109. foundFilename = filename;
  110. // Rspack does not yet support `assetsInfo`, so we need to check if `assetsInfo` exists here
  111. if (assetsInfo) {
  112. const assetInfo = assetsInfo.get(pathname.slice(publicPathObject.pathname.length));
  113. // eslint-disable-next-line no-param-reassign
  114. extra.immutable = assetInfo ? assetInfo.immutable : false;
  115. }
  116. break;
  117. } else if (extra.stats.isDirectory() && (typeof options.index === "undefined" || options.index)) {
  118. const indexValue = typeof options.index === "undefined" || typeof options.index === "boolean" ? "index.html" : options.index;
  119. filename = path.join(filename, indexValue);
  120. try {
  121. // eslint-disable-next-line no-param-reassign
  122. extra.stats = context.outputFileSystem.statSync(filename);
  123. } catch (__ignoreError) {
  124. // eslint-disable-next-line no-continue
  125. continue;
  126. }
  127. if (extra.stats.isFile()) {
  128. foundFilename = filename;
  129. break;
  130. }
  131. }
  132. }
  133. }
  134. // eslint-disable-next-line consistent-return
  135. return foundFilename;
  136. }
  137. module.exports = getFilenameFromUrl;