Yessiest
/
landline
1
1
Fork 0
Code Issues 3 Pull Requests Projects 1 Releases Wiki Activity

Compare commits

base: Yessiest:9ba3bddc9645d245f440c6406da4fb58f6f2fc35
Branches Tags
Yessiest:master
...
compare: Yessiest:9c9ceaf4f8e479bc24eff9cf42c281276a4ad9dc
Branches Tags
Yessiest:master

2 Commits
9ba3bddc96 ... 9c9ceaf4f8

Author SHA1 Message Date
Yessiest 9c9ceaf4f8 Also actual files for the previous commit (how did i forget to do that) 2023-09-09 00:07:43 +04:00
Yessiest 8894a9a55f Mitigated directory traversal in ServeHandler 2023-09-09 00:07:06 +04:00
11 changed files with 70 additions and 23 deletions
Show Stats Expand all files Collapse all files

4
examples/norxondor_gorgonax/config.ru
View File

@ -13,9 +13,9 @@ app = Hyde::Server.new do
postprocess do |request, response|
puts "Request: #{request}, response: #{response}"
end
index ["index"]
index ["index.html"]
root "#{ENV['PWD']}/assets"
serve "*.(html|css|js)"
serve "/**/*.(html|css|js)"
get "/wormhole/:test/*" do |suffix, test: nil|
<<~RESPONSE
You tried accessing #{suffix} at named param #{test}

13
examples/norxondor_gorgonax/index.html Normal file
View File

@ -0,0 +1,13 @@
<!DOCTYPE html>
<html>
<head>
<title> Cleverly done, mr. freeman </title>
</head>
<body>
<h1>Cleverly done, mr. freeman</h1>
<hr/>
<p>But you are not supposed to be here</p>
<p><b>Get back where you belong.</b></p>
</body>
</html>

5
lib/hyde/dsl/path_methods.rb
View File

@ -21,16 +21,13 @@ module Hyde
# Set root path (appends matched part of the path).
# @param path [String
def root(path)
raise StandardError, "path should be a String" unless path.is_a? String
@origin.root = path
end
# Set root path (without appending matched part).
# @param path [String
def remap(path)
root(path)
@origin.remap = true
@origin.remap = path
end
# Add a preprocessor to the path.

21
lib/hyde/node.rb
View File

@ -9,12 +9,29 @@ module Hyde
# @abstract
class Node
# @param path [Object]
def initialize(path)
def initialize(path, parent:)
@pattern = Pattern.new(path).freeze
@properties = Hyde::Util::Lookup.new(parent&.properties)
@root = nil
@remap = false
end
# Set Node file root (like root in Nginx)
# @param path [String]
def root=(path)
raise StandardError, "path should be a String" unless path.is_a? String
@properties["path"] = File.expand_path(path)
@root = File.expand_path(path)
end
# Set Node absolute file path (like alias in Nginx)
# @param path [String]
def remap=(path)
self.root = path
@remap = true
end
# Try to navigate the path. Run method callback in response.
# @param [Hyde::Request]
# @return [Boolean]
@ -49,7 +66,7 @@ module Hyde
true
end
attr_accessor :remap, :root
attr_reader :remap, :root
private

4
lib/hyde/path.rb
View File

@ -25,11 +25,9 @@ module Hyde
# @param parent [Hyde::Node] Parent object to inherit properties to
# @param setup [#call] Setup block
def initialize(path, parent:, &setup)
super(path)
super(path, parent: parent)
# Child nodes array
@children = []
# Inherited properties array
@properties = Hyde::Util::Lookup.new(parent&.properties)
# Arrays of preprocessors, postprocessors and filters
@preprocessors = []
@postprocessors = []

8
lib/hyde/pattern_matching/glob.rb
View File

@ -100,11 +100,12 @@ module Hyde
private
# i shall name thee Norxondor Glorbulon
# Regexp pattern to match glob tokens
TOKENS = /
( # Glob-specific tokens
\/\*\*\/ | # Freestanding globstar
\*\* | # Attached globstar
(?<=(?:\/|^))\*\*(?:\/|$) | # Freestanding globstar
\* | # Regular glob
\[!?\w-\w\]\+ | # Character group
(?<=\/):[\w_]+(?=(?:\/|$)) | # Named glob
@ -153,8 +154,7 @@ module Hyde
def build_regexp(tokens)
Regexp.new(tokens.map do |filter|
case filter
when "/**/" then "/(?:(.*)\/|)" # FIXME: this may return nil
when "**" then "(.*)"
when /(\/|^)\*\*(\/|$)/ then "(?:(.*)/|)" # FIXME: this may return nil
when "*" then "([^/]*)"
when /^\([\w\/|_-]+\)$/ then filter.sub('-', '\\-')
when /^\[!?\w-\w\]\+$/ then filter.sub('!', '^')

3
lib/hyde/probe.rb
View File

@ -21,8 +21,7 @@ module Hyde
# @param path [Object]
# @param parent [Hyde::Node]
def initialize(path, parent:)
super(path)
@properties = Hyde::Util::Lookup.new(parent&.properties)
super(path, parent: parent)
end
attr_reader :properties

5
lib/hyde/probe/serve_handler.rb
View File

@ -20,7 +20,10 @@ module Hyde
# @param request [Hyde::Request]
# @return [Boolean] true if file was found
def process(request)
File.open(request.filepath.delete_suffix("/"))
path = File.expand_path(request.filepath)
return unless path.start_with? @properties["path"]
File.open(path.delete_suffix("/"))
rescue StandardError
false
end

2
lib/hyde/request.rb
View File

@ -15,7 +15,7 @@ module Hyde
@param = {}
@splat = []
# Traversal route. Public and writable.
@path = env["PATH_INFO"].dup
@path = URI.decode_www_form_component(env["PATH_INFO"].dup)
# File serving path. Public and writable.
@filepath = "/"
# Encapsulates all rack variables. Should not be public.

7
lib/hyde/server.rb
View File

@ -28,10 +28,9 @@ module Hyde
"content-type": "text/html"
}
[headers, page]
end
}.each do |k, v|
@properties[k] = v unless @properties[k]
end
end,
"path" => "/"
}.each { |k, v| @properties[k] = v unless @properties[k] }
end
# Rack ingress point.

21
test/Hyde_PatternMatching_Glob.rb
View File

@ -69,6 +69,27 @@ class TestGlob < Test::Unit::TestCase
puts("Testing: #{test}")
assert_equal(result, unit.match?(test))
end
unit = Glob.new("**/*.php")
[
"archive.php", true,
"assets/thing.js", false,
"assetsthing.js", false,
"parts/thing.php", true,
"partsthing.php", true,
".php", true,
"parts/extra/test.php", true,
"archive.php", true,
"assets/thing.js", false,
"assetsthing.js", false,
"parts/thing.php", true,
"partsthing.php", true,
".php", true,
"parts/extra/test.php", true,
"parts/extra/test.php/literally/anything/here", true
].each_slice(2) do |test, result|
puts("Testing: #{test}")
assert_equal(result, unit.match?(test))
end
puts "Test group: char ranges"
unit = Glob.new("/test/[9-z]+")
[