Implement secure static files server with traversal protection

.github/workflows/test.yml-template

@@ -0,0 +1,23 @@
+name: Test
+
+on:
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [20.x]
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v1
+      with:
+        node-version: ${{ matrix.node-version }}
+    - run: npm install
+    - run: npm test

package.json

@@ -18,7 +18,7 @@
   "devDependencies": {
     "@faker-js/faker": "^8.4.1",
     "@mate-academy/eslint-config": "latest",
-    "@mate-academy/scripts": "^1.8.6",
+    "@mate-academy/scripts": "^2.1.3",
     "axios": "^1.7.2",
     "eslint": "^8.57.0",
     "eslint-plugin-jest": "^28.6.0",

src/createServer.js

@@ -1,8 +1,107 @@
 'use strict';
 
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+
+const PUBLIC_DIR = path.resolve(__dirname, '..', 'public');
+
+const MIME_TYPES = {
+  '.html': 'text/html',
+  '.css': 'text/css',
+  '.js': 'application/javascript',
+  '.json': 'application/json',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.svg': 'image/svg+xml',
+  '.ico': 'image/x-icon',
+  '.txt': 'text/plain',
+};
+
+const FILELIKE_EXTS = new Set(Object.keys(MIME_TYPES));
+
+function send(res, statusCode, body, contentType = 'text/plain') {
+  res.statusCode = statusCode;
+  res.setHeader('Content-Type', contentType);
+  res.end(body);
+}
+
 function createServer() {
-  /* Write your code here */
-  // Return instance of http.Server class
+  return http.createServer((req, res) => {
+    const rawUrl = req.url || '';
+    const rawPath = rawUrl.split('?')[0];
+
+    let forcePlain = false;
+
+    if (rawPath === '/file') {
+      forcePlain = true;
+    } else if (!rawPath.startsWith('/file/')) {
+      const ext = path.extname(rawPath).toLowerCase();
+
+      if (FILELIKE_EXTS.has(ext)) {
+        send(res, 400, 'Bad Request');
+
+        return;
+      }
+
+      send(
+        res,
+        200,
+        'Use /file/<path> to load static files from public folder',
+      );
+
+      return;
+    }
+
+    const relRaw = rawPath === '/file' ? '' : rawPath.slice('/file/'.length);
+
+    if (relRaw.includes('//')) {
+      send(res, 404, 'Not Found');
+
+      return;
+    }
+
+    let relDecoded;
+
+    try {
+      relDecoded = relRaw ? decodeURIComponent(relRaw) : 'index.html';
+    } catch {
+      send(res, 400, 'Bad Request');
+
+      return;
+    }
+
+    const filePath = path.resolve(PUBLIC_DIR, relDecoded);
+    const relToPublic = path.relative(PUBLIC_DIR, filePath);
+
+    if (relToPublic.startsWith('..') || path.isAbsolute(relToPublic)) {
+      send(res, 400, 'Bad Request');
+
+      return;
+    }
+
+    fs.stat(filePath, (err, stats) => {
+      if (err || !stats.isFile()) {
+        send(res, 404, 'Not Found');
+
+        return;
+      }
+
+      const ext = path.extname(filePath).toLowerCase();
+      const contentType = forcePlain
+        ? 'text/plain'
+        : MIME_TYPES[ext] || 'application/octet-stream';
+
+      res.statusCode = 200;
+      res.setHeader('Content-Type', contentType);
+
+      fs.createReadStream(filePath)
+        .on('error', () => send(res, 404, 'Not Found'))
+        .pipe(res);
+    });
+  });
 }
 
 module.exports = {