Last active
February 27, 2025 06:28
-
Star
(544)
You must be signed in to star a gist -
Fork
(204)
You must be signed in to fork a gist
-
-
Save ryanflorence/701407 to your computer and use it in GitHub Desktop.
Node.JS static file web server. Put it in your path to fire up servers in any directory, takes an optional port argument.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
var http = require("http"), | |
url = require("url"), | |
path = require("path"), | |
fs = require("fs") | |
port = process.argv[2] || 8888; | |
http.createServer(function(request, response) { | |
var uri = url.parse(request.url).pathname | |
, filename = path.join(process.cwd(), uri); | |
path.exists(filename, function(exists) { | |
if(!exists) { | |
response.writeHead(404, {"Content-Type": "text/plain"}); | |
response.write("404 Not Found\n"); | |
response.end(); | |
return; | |
} | |
if (fs.statSync(filename).isDirectory()) filename += '/index.html'; | |
fs.readFile(filename, "binary", function(err, file) { | |
if(err) { | |
response.writeHead(500, {"Content-Type": "text/plain"}); | |
response.write(err + "\n"); | |
response.end(); | |
return; | |
} | |
response.writeHead(200); | |
response.write(file, "binary"); | |
response.end(); | |
}); | |
}); | |
}).listen(parseInt(port, 10)); | |
console.log("Static file server running at\n => http://localhost:" + port + "/\nCTRL + C to shutdown"); |
Thanks a lot, but it can be hijacked
This is insecure, someone can request /../../../etc/shadow
or similar to read any file they want.
thanks ...it's great, that why I'm looking for it
path.exists is now called fs.exists
This is insecure, someone can request
/../../../etc/shadow
or similar to read any file they want.
I guess you're not familiar with how path.join works, because as coded here it won't resolve to a directory outside of cwd directory branch.
fs.exists
is deprecated. fs.statSync
can be used to check if file path exists, as in dkebler's code above.
Thank you for this!
Incredible article, thanks for sharing it! I think this article will also be useful for you - Node js vs Python.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Thanks a lot :)