Make setDirectoryHandler and setErrorPageHandler setters, and add a jailRoot property.

pkg/http_server/lib/src/virtual_directory.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of http_server;
 
 /**
  * A [VirtualDirectory] can serve files and directory-listing from a root path,
  * to [HttpRequest]s.
  *
  * The [VirtualDirectory] providing secure handling of request uris and
  * file-system links, correct mime-types and custom error pages.
  */
-abstract class VirtualDirectory {
+class VirtualDirectory {
   final String root;
 
   /**
    * Set or get if the [VirtualDirectory] should list the content of
    * directories.
    */
   bool allowDirectoryListing = false;
 
   /**
    * Set or get if the [VirtualDirectory] should follow links, that point
    * to other resources within the [root] directory.
    */
   bool followLinks = true;
 
+  /**
+   * Set or get if the [VirtualDirectory] should jail the root. When the root is
+   * not jailed, links can be followed to outside the [root] directory.
+   */
+  bool jailRoot = true;

[Søren Gjesse, 2013/10/21 10:44:31]

I don't have better names ("confineToRoot" or "onlyServeInsideRoot" are probably
not any better).

[Anders Johnsen, 2013/10/21 12:20:27]

Done.

+
+  final RegExp _invalidPathRegExp = new RegExp("[\\\/\x00]");
+
+  Function _errorCallback;
+  Function _dirCallback;
+
   /*
    * Create a new [VirtualDirectory] for serving static file content of
    * the path [root].
    *
    * The [root] is not required to exist. If the [root] doesn't exist at time of
    * a request, a 404 is generated.
    */
-  factory VirtualDirectory(String root) => new _VirtualDirectory(root);
+  VirtualDirectory(this.root);
 
   /**
    * Serve a [Stream] of [HttpRequest]s, in this [VirtualDirectory].
    */
-  void serve(Stream<HttpRequest> requests);
+  void serve(Stream<HttpRequest> requests) {
+    requests.listen(serveRequest);
+  }
 
   /**
    * Serve a single [HttpRequest], in this [VirtualDirectory].
    */
-  void serveRequest(HttpRequest request);
-
-  /**
-   * Set the [callback] to override the default directory listing. The
-   * [callback] will be called with the [Directory] to be listed and the
-   * [HttpRequest].
-   */
-  void setDirectoryHandler(void callback(Directory dir, HttpRequest request));
-
-  /**
-   * Set the [callback] to override the error page handler. When [callback] is
-   * invoked, the `statusCode` property of the response is set.
-   */
-  void setErrorPageHandler(void callback(HttpRequest request));
-}
-
-class _VirtualDirectory implements VirtualDirectory {
-  final String root;
-
-  bool allowDirectoryListing = false;
-  bool followLinks = true;
-
-  final RegExp _invalidPathRegExp = new RegExp("[\\\/\x00]");
-
-  Function _errorCallback;
-  Function _dirCallback;
-
-  _VirtualDirectory(this.root);
-
-  void serve(Stream<HttpRequest> requests) {
-    requests.listen(serveRequest);
-  }
-
   void serveRequest(HttpRequest request) {
     _locateResource('.', request.uri.pathSegments.iterator..moveNext())
         .then((entity) {
           if (entity == null) {
             _serveErrorPage(HttpStatus.NOT_FOUND, request);
             return;
           }
           if (entity is File) {
             _serveFile(entity, request);
           } else if (entity is Directory) {
             _serveDirectory(entity, request);
           } else {
             _serveErrorPage(HttpStatus.NOT_FOUND, request);
           }
         });
   }
 
-  void setDirectoryHandler(void callback(Directory dir, HttpRequest request)) {
+  /**
+   * Set the [callback] to override the default directory listing. The
+   * [callback] will be called with the [Directory] to be listed and the
+   * [HttpRequest].
+   */
+  void set directoryHandler(void callback(Directory dir, HttpRequest request)) {
     _dirCallback = callback;
   }
 
-  void setErrorPageHandler(void callback(HttpRequest request)) {
+  /**
+   * Set the [callback] to override the error page handler. When [callback] is
+   * invoked, the `statusCode` property of the response is set.
+   */
+  void set errorPageHandler(void callback(HttpRequest request)) {
     _errorCallback = callback;
   }
 
   Future<FileSystemEntity> _locateResource(String path,
                                            Iterator<String> segments) {
+    // Don't allow navigating up paths.
+    if (segments.current == "..") return new Future.value(null);
     path = normalize(path);
-    if (split(path).first == "..") return new Future.value(null);
+    // If we jail to root, the relative path can never go up.
+    if (jailRoot && split(path).first == "..") return new Future.value(null);
     String fullPath() => join(root, path);
     return FileSystemEntity.type(fullPath(), followLinks: false)
         .then((type) {
           switch (type) {
             case FileSystemEntityType.FILE:
               if (segments.current == null) {
                 return new File(fullPath());
               }
               break;
 
             case FileSystemEntityType.DIRECTORY:
               if (segments.current == null) {
                 if (allowDirectoryListing) {
                   return new Directory(fullPath());
                 }
               } else {
                 if (_invalidPathRegExp.hasMatch(segments.current)) break;
                 return _locateResource(join(path, segments.current),
                                        segments..moveNext());
               }
               break;
 
             case FileSystemEntityType.LINK:
               if (followLinks) {
                 return new Link(fullPath()).target()
                     .then((target) {
+                      print("Link target: $target");

[Søren Gjesse, 2013/10/21 10:44:31]

Debug print.

[Anders Johnsen, 2013/10/21 12:20:27]

Done.

                       String targetPath = normalize(target);
-                      if (isAbsolute(targetPath)) return null;
-                      targetPath = join(dirname(path), targetPath);
-                      return _locateResource(targetPath, segments);
+                      if (isAbsolute(targetPath)) {
+                        // If we jail to root, the path can never be absolute.
+                        if (jailRoot) return null;
+                        print(targetPath);

[Søren Gjesse, 2013/10/21 10:44:31]

Ditto.

[Anders Johnsen, 2013/10/21 12:20:27]

Done.

+                        return _locateResource(targetPath, segments);
+                      } else {
+                        targetPath = join(dirname(path), targetPath);
+                        return _locateResource(targetPath, segments);
+                      }
                     });
               }
               break;
           }
           // Return `null` on fall-through, to indicate NOT_FOUND.
           return null;
         });
   }
 
   void _serveFile(File file, HttpRequest request) {
@@ skipping 218 matching lines @@
 
   Future close() => new Future.value();
 
   void setMimeType(var bytes) {
     var mimeType = lookupMimeType(path, headerBytes: bytes);
     if (mimeType != null) {
       response.headers.contentType = ContentType.parse(mimeType);
     }
   }
 }