tookeyman/vinegar
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fixing up some directory traversal attacks round 4

Browse Source
This commit is contained in:
dtookey 2023-07-31 15:40:51 -04:00
parent a3ff0f57b3
commit 0aedf80727
5 changed files with 35 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
servlet/config.go
View File

@ -58,7 +58,7 @@ func CreateBlankConfig() *Config {
return &conf return &conf
} }
func LoadConfig(pathlike string) *VinegarServlet { func LoadConfig(pathlike string) *VinegarHttpServlet {
contents, exists := vinegarUtil.GetDiskContent(pathlike) contents, exists := vinegarUtil.GetDiskContent(pathlike)
if exists { if exists {
conf := Config{} conf := Config{}
@ -86,7 +86,7 @@ func LoadConfig(pathlike string) *VinegarServlet {
} }
} }
func (e ConfigEntry) toRoute(serv *VinegarServlet) { func (e ConfigEntry) toRoute(serv *VinegarHttpServlet) {
constructor, err := getConstructorFunction(e.ConfigType) constructor, err := getConstructorFunction(e.ConfigType)
if err != nil { if err != nil {
panic(err) panic(err)

4
servlet/dynamicRoute.go
View File

@ -7,7 +7,7 @@ import (
type ( type (
ApiRoute struct { ApiRoute struct {
VinegarRoute *VinegarRoute VinegarRoute *VinegarWebRoute
HttpMethodRoutes *map[HttpMethod]VinegarHandlerFunction HttpMethodRoutes *map[HttpMethod]VinegarHandlerFunction
} }
) )
@ -25,7 +25,7 @@ const (
UNDEFINED UNDEFINED
) )
func NewApiRoute(serv *VinegarServlet, pattern string) *ApiRoute { func NewApiRoute(serv *VinegarHttpServlet, pattern string) *ApiRoute {
functionMap := make(map[HttpMethod]VinegarHandlerFunction) functionMap := make(map[HttpMethod]VinegarHandlerFunction)
ancestorRoute := NewServletRoute(pattern, createMethodHandler(&functionMap)) ancestorRoute := NewServletRoute(pattern, createMethodHandler(&functionMap))
route := ApiRoute{ route := ApiRoute{

33
servlet/server.go
View File

@ -25,20 +25,20 @@ type ErrorResponse struct {
} }
type ( type (
// VinegarServlet is the main server struct that handles HTTP requests and routing. // VinegarHttpServlet is the main server struct that handles HTTP requests and routing.
// It contains the TCP port to listen on, the routes to match requests against, // It contains the TCP port to listen on, the routes to match requests against,
// and a map of status code to error handling routes. // and a map of status code to error handling routes.
VinegarServlet struct { VinegarHttpServlet struct {
Port string Port string
Routes []*VinegarRoute Routes []*VinegarWebRoute
ErrorRoutes map[int]*TemplateRoute ErrorRoutes map[int]*TemplateRoute
} }
// VinegarRoute defines a single route in the router. // VinegarWebRoute defines a single route in the router.
// It contains a regex Pattern to match against the URL path, // It contains a regex Pattern to match against the URL path,
// a Handler function to call when the route matches, // a Handler function to call when the route matches,
// and an optional Cache to enable caching for the route. // and an optional Cache to enable caching for the route.
VinegarRoute struct { VinegarWebRoute struct {
Pattern *regexp.Regexp Pattern *regexp.Regexp
Handler VinegarHandlerFunction Handler VinegarHandlerFunction
Cache vinegarUtil.Cache Cache vinegarUtil.Cache
@ -47,32 +47,31 @@ type (
VinegarHandlerFunction func(w http.ResponseWriter, req *http.Request) VinegarHandlerFunction func(w http.ResponseWriter, req *http.Request)
) )
func NewServlet(port string) *VinegarServlet { func NewServlet(port string) *VinegarHttpServlet {
errors := make(map[int]*TemplateRoute) errs := make(map[int]*TemplateRoute)
srv := VinegarServlet{Port: port, ErrorRoutes: errors} srv := VinegarHttpServlet{Port: port, ErrorRoutes: errs}
return &srv return &srv
} }
func NewServletRoute(routePattern string, handleFunc VinegarHandlerFunction) *VinegarRoute { func NewServletRoute(routePattern string, handleFunc VinegarHandlerFunction) *VinegarWebRoute {
pattern := regexp.MustCompile(routePattern) pattern := regexp.MustCompile(routePattern)
route := VinegarRoute{Pattern: pattern, Handler: handleFunc, Cache: vinegarUtil.NewLRU(defaultLruSize)} route := VinegarWebRoute{Pattern: pattern, Handler: handleFunc, Cache: vinegarUtil.NewLRU(defaultLruSize)}
return &route return &route
} }
func (s *VinegarServlet) AddRoute(route *VinegarRoute) { func (s *VinegarHttpServlet) AddRoute(route *VinegarWebRoute) {
route.Announce() route.Announce()
s.Routes = append(s.Routes, route) s.Routes = append(s.Routes, route)
} }
func (s *VinegarServlet) AddErrorRoute(code int, route *TemplateRoute) { func (s *VinegarHttpServlet) AddErrorRoute(code int, route *TemplateRoute) {
route.Announce() route.Announce()
s.ErrorRoutes[code] = route s.ErrorRoutes[code] = route
} }
func (s *VinegarServlet) ServeHTTP(w http.ResponseWriter, req *http.Request) { func (s *VinegarHttpServlet) ServeHTTP(w http.ResponseWriter, req *http.Request) {
path := req.URL.Path path := req.URL.Path
for _, route := range s.Routes { for _, route := range s.Routes {
if route.Pattern.MatchString(path) { if route.Pattern.MatchString(path) {
@ -84,7 +83,7 @@ func (s *VinegarServlet) ServeHTTP(w http.ResponseWriter, req *http.Request) {
s.SendError(w, req, 404, "Couldn't find your content.", errors.New("failed to match route for ["+path+"]")) s.SendError(w, req, 404, "Couldn't find your content.", errors.New("failed to match route for ["+path+"]"))
} }
func (s *VinegarServlet) Start() { func (s *VinegarHttpServlet) Start() {
if len(s.Routes) < 1 { if len(s.Routes) < 1 {
log.Fatal("No routes found for server. Nothing to listen and serve.") log.Fatal("No routes found for server. Nothing to listen and serve.")
os.Exit(1) os.Exit(1)
@ -100,11 +99,11 @@ func (s *VinegarServlet) Start() {
} }
func (r *VinegarRoute) Announce() { func (r *VinegarWebRoute) Announce() {
log.Printf("Added route for [%s]\n", r.Pattern.String()) log.Printf("Added route for [%s]\n", r.Pattern.String())
} }
func (s *VinegarServlet) SendError(w http.ResponseWriter, req *http.Request, code int, msg string, aErr error) { func (s *VinegarHttpServlet) SendError(w http.ResponseWriter, req *http.Request, code int, msg string, aErr error) {
fmt.Printf("[%d][%s]. Rendering template for code %d with message: %s\n", code, req.URL.Path, code, msg) fmt.Printf("[%d][%s]. Rendering template for code %d with message: %s\n", code, req.URL.Path, code, msg)
fmt.Println(aErr) fmt.Println(aErr)
tmpl, exists := s.ErrorRoutes[code] tmpl, exists := s.ErrorRoutes[code]

22
servlet/staticRoute.go
View File

@ -15,10 +15,10 @@ type (
FileRoute struct { FileRoute struct {
// VinegarRoute is the base route containing the URL pattern and handler. // VinegarRoute is the base route containing the URL pattern and handler.
VinegarRoute *VinegarRoute VinegarRoute *VinegarWebRoute
// srv is the VinegarServlet instance that this route is attached to. // srv is the VinegarHttpServlet instance that this route is attached to.
srv *VinegarServlet srv *VinegarHttpServlet
// fileRoot is the base file path to serve files from. // fileRoot is the base file path to serve files from.
fileRoot string fileRoot string
@ -31,7 +31,7 @@ type (
// //
//Params: //Params:
// //
//servlet - The VinegarServlet instance to add the route to //servlet - The VinegarHttpServlet instance to add the route to
// //
//urlPattern - The URL regex pattern for route to match //urlPattern - The URL regex pattern for route to match
// //
@ -39,13 +39,13 @@ type (
// //
//useCache - Whether to use caching for this route //useCache - Whether to use caching for this route
// //
// A RouteConstructor is a function that accepts a VinegarServlet, urlPattern, file path, and cache option. It uses // A RouteConstructor is a function that accepts a VinegarHttpServlet, urlPattern, file path, and cache option. It uses
// these to construct and return a FileRoute. // these to construct and return a FileRoute.
// The return value is a FileRoute that will serve the files from the given path. // The return value is a FileRoute that will serve the files from the given path.
// //
// This function signature allows encapsulating the creation of different types of FileRoutes. It is used to define // This function signature allows encapsulating the creation of different types of FileRoutes. It is used to define
// constructor functions for each file type, like NewTextRoute or NewImageRoute. // constructor functions for each file type, like NewTextRoute or NewImageRoute.
RouteConstructor func(servlet *VinegarServlet, urlPattern string, pathlike string, useCache bool) *FileRoute RouteConstructor func(servlet *VinegarHttpServlet, urlPattern string, pathlike string, useCache bool) *FileRoute
) )
// NewTextRoute creates a new FileRoute for serving text files. // NewTextRoute creates a new FileRoute for serving text files.
@ -54,7 +54,7 @@ type (
// //
// Parameters: // Parameters:
// //
// servlet - The VinegarServlet instance to attach the route to. // servlet - The VinegarHttpServlet instance to attach the route to.
// //
// urlPattern - The URL regex pattern that triggers this route. // urlPattern - The URL regex pattern that triggers this route.
// //
@ -65,8 +65,8 @@ type (
// Returns: // Returns:
// //
// A FileRoute instance configured for serving text files, added to // A FileRoute instance configured for serving text files, added to
// the provided VinegarServlet. // the provided VinegarHttpServlet.
var NewTextRoute RouteConstructor = func(servlet *VinegarServlet, urlPattern string, pathlike string, useCache bool) *FileRoute { var NewTextRoute RouteConstructor = func(servlet *VinegarHttpServlet, urlPattern string, pathlike string, useCache bool) *FileRoute {
fileRoot := filepath.Clean(pathlike) fileRoot := filepath.Clean(pathlike)
if strings.Contains(fileRoot, "../") { if strings.Contains(fileRoot, "../") {
panic("Traversing the directory is not allowed, use an absolute filepath instead") panic("Traversing the directory is not allowed, use an absolute filepath instead")
@ -82,7 +82,7 @@ var NewTextRoute RouteConstructor = func(servlet *VinegarServlet, urlPattern str
return &route return &route
} }
var NewImageRoute RouteConstructor = func(servlet *VinegarServlet, urlPattern string, pathlike string, useCache bool) *FileRoute { var NewImageRoute RouteConstructor = func(servlet *VinegarHttpServlet, urlPattern string, pathlike string, useCache bool) *FileRoute {
fileRoot := filepath.Clean(pathlike) fileRoot := filepath.Clean(pathlike)
if strings.Contains(fileRoot, "../") { if strings.Contains(fileRoot, "../") {
panic("Traversing the directory is not allowed, use an absolute filepath instead") panic("Traversing the directory is not allowed, use an absolute filepath instead")
@ -96,7 +96,7 @@ var NewImageRoute RouteConstructor = func(servlet *VinegarServlet, urlPattern st
return &route return &route
} }
var NewSingleFileRoute RouteConstructor = func(servlet *VinegarServlet, urlPattern string, pathlike string, useCache bool) *FileRoute { var NewSingleFileRoute RouteConstructor = func(servlet *VinegarHttpServlet, urlPattern string, pathlike string, useCache bool) *FileRoute {
route := FileRoute{ route := FileRoute{
srv: servlet, srv: servlet,
fileRoot: pathlike, fileRoot: pathlike,

8
servlet/templateRoute.go
View File

@ -7,8 +7,8 @@ import (
type ( type (
TemplateRoute struct { TemplateRoute struct {
*VinegarRoute *VinegarWebRoute
srv *VinegarServlet srv *VinegarHttpServlet
fileRoot string fileRoot string
TemplateManager *TemplateManager TemplateManager *TemplateManager
UseCache bool UseCache bool
@ -16,12 +16,12 @@ type (
TemplateRouteHandlerFunc func(w http.ResponseWriter, r *http.Request, tm *TemplateManager) TemplateRouteHandlerFunc func(w http.ResponseWriter, r *http.Request, tm *TemplateManager)
) )
func NewTemplateRoute(servlet *VinegarServlet, urlPattern string, templatePath string, componentPath string, handler TemplateRouteHandlerFunc) *TemplateRoute { func NewTemplateRoute(servlet *VinegarHttpServlet, urlPattern string, templatePath string, componentPath string, handler TemplateRouteHandlerFunc) *TemplateRoute {
defaultPrune := strings.Replace(urlPattern, ".*", "", -1) defaultPrune := strings.Replace(urlPattern, ".*", "", -1)
tm := NewTemplateManager(templatePath, componentPath) tm := NewTemplateManager(templatePath, componentPath)
rootRoute := NewServletRoute(defaultPrune, createTemplateRouteFunction(tm, handler)) rootRoute := NewServletRoute(defaultPrune, createTemplateRouteFunction(tm, handler))
route := TemplateRoute{ route := TemplateRoute{
VinegarRoute: rootRoute, VinegarWebRoute: rootRoute,
srv: servlet, srv: servlet,
fileRoot: "", fileRoot: "",
TemplateManager: tm, TemplateManager: tm,