refactor: use config.wwwroot instead of current working directory as a webroot in internal code

src/handlers/clientErrorHandler.js

@@ -12,6 +12,9 @@ let serverconsole = {};
 function clientErrorHandler(err, socket) {
   const config = deepClone(process.serverConfig);
 
+  // Determine the webroot from the current working directory if it is not configured
+  if (config.wwwroot === undefined) config.wwwroot = process.cwd();
+
   config.generateServerString = () =>
     generateServerString(config.exposeServerVersion);
 
@@ -182,14 +185,14 @@ function clientErrorHandler(err, socket) {
             fs.access(config.page404, fs.constants.F_OK, (err) => {
               if (err) {
                 fs.access(
-                  "." + errorCode.toString(),
+                  config.wwwroot + "/." + errorCode.toString(),
                   fs.constants.F_OK,
                   (err) => {
                     try {
                       if (err) {
                         callback(errorCode.toString() + ".html");
                       } else {
-                        callback("." + errorCode.toString());
+                        callback(config.wwwroot + "/." + errorCode.toString());
                       }
                     } catch (err2) {
                       callServerError(500, err2);
@@ -205,17 +208,21 @@ function clientErrorHandler(err, socket) {
               }
             });
           } else {
-            fs.access("." + errorCode.toString(), fs.constants.F_OK, (err) => {
+            fs.access(
-              try {
+              config.wwwroot + "/." + errorCode.toString(),
-                if (err) {
+              fs.constants.F_OK,
-                  callback(errorCode.toString() + ".html");
+              (err) => {
-                } else {
+                try {
-                  callback("." + errorCode.toString());
+                  if (err) {
+                    callback(errorCode.toString() + ".html");
+                  } else {
+                    callback(config.wwwroot + "/." + errorCode.toString());
+                  }
+                } catch (err2) {
+                  callServerError(500, err2);
                 }
-              } catch (err2) {
-                callServerError(500, err2);
               }
-            });
+            );
           }
         }
       };
@@ -457,15 +464,15 @@ function clientErrorHandler(err, socket) {
     } sent invalid request.`
   );
   try {
-    head = fs.existsSync("./.head")
+    head = fs.existsSync(`${config.wwwroot}/.head`)
-      ? fs.readFileSync("./.head").toString()
+      ? fs.readFileSync(`${config.wwwroot}/.head`).toString()
-      : fs.existsSync("./head.html")
+      : fs.existsSync(`${config.wwwroot}/head.html`)
-        ? fs.readFileSync("./head.html").toString()
+        ? fs.readFileSync(`${config.wwwroot}/head.html`).toString()
         : ""; // header
-    foot = fs.existsSync("./.foot")
+    foot = fs.existsSync(`${config.wwwroot}/.foot`)
-      ? fs.readFileSync("./.foot").toString()
+      ? fs.readFileSync(`${config.wwwroot}/.foot`).toString()
-      : fs.existsSync("./foot.html")
+      : fs.existsSync(`${config.wwwroot}/foot.html`)
-        ? fs.readFileSync("./foot.html").toString()
+        ? fs.readFileSync(`${config.wwwroot}/foot.html`).toString()
         : ""; // footer
 
     if (

src/handlers/proxyHandler.js

@@ -32,6 +32,9 @@ function proxyHandler(req, socket, head) {
   // SVR.JS configuration object (modified)
   const config = deepClone(process.serverConfig);
 
+  // Determine the webroot from the current working directory if it is not configured
+  if (config.wwwroot === undefined) config.wwwroot = process.cwd();
+
   config.generateServerString = () =>
     generateServerString(config.exposeServerVersion);
 

src/handlers/requestHandler.js

@@ -37,6 +37,9 @@ function requestHandler(req, res) {
   config.generateServerString = () =>
     generateServerString(config.exposeServerVersion);
 
+  // Determine the webroot from the current working directory if it is not configured
+  if (config.wwwroot === undefined) config.wwwroot = process.cwd();
+
   // getCustomHeaders() in SVR.JS 3.x
   config.getCustomHeaders = () => {
     let ph = Object.assign({}, config.customHeaders);
@@ -345,14 +348,14 @@ function requestHandler(req, res) {
             fs.access(config.page404, fs.constants.F_OK, (err) => {
               if (err) {
                 fs.access(
-                  "." + errorCode.toString(),
+                  config.wwwroot + "/." + errorCode.toString(),
                   fs.constants.F_OK,
                   (err) => {
                     try {
                       if (err) {
                         callback(errorCode.toString() + ".html");
                       } else {
-                        callback("." + errorCode.toString());
+                        callback(config.wwwroot + "/." + errorCode.toString());
                       }
                     } catch (err2) {
                       res.error(500, err2);
@@ -368,17 +371,21 @@ function requestHandler(req, res) {
               }
             });
           } else {
-            fs.access("." + errorCode.toString(), fs.constants.F_OK, (err) => {
+            fs.access(
-              try {
+              config.wwwroot + "/." + errorCode.toString(),
-                if (err) {
+              fs.constants.F_OK,
-                  callback(errorCode.toString() + ".html");
+              (err) => {
-                } else {
+                try {
-                  callback("." + errorCode.toString());
+                  if (err) {
+                    callback(errorCode.toString() + ".html");
+                  } else {
+                    callback(config.wwwroot + "/." + errorCode.toString());
+                  }
+                } catch (err2) {
+                  res.error(500, err2);
                 }
-              } catch (err2) {
-                res.error(500, err2);
               }
-            });
+            );
           }
         }
       };
@@ -633,15 +640,15 @@ function requestHandler(req, res) {
   };
 
   try {
-    res.head = fs.existsSync("./.head")
+    res.head = fs.existsSync(`${config.wwwroot}/.head`)
-      ? fs.readFileSync("./.head").toString()
+      ? fs.readFileSync(`${config.wwwroot}/.head`).toString()
-      : fs.existsSync("./head.html")
+      : fs.existsSync(`${config.wwwroot}/head.html`)
-        ? fs.readFileSync("./head.html").toString()
+        ? fs.readFileSync(`${config.wwwroot}/head.html`).toString()
         : ""; // header
-    res.foot = fs.existsSync("./.foot")
+    res.foot = fs.existsSync(`${config.wwwroot}/.foot`)
-      ? fs.readFileSync("./.foot").toString()
+      ? fs.readFileSync(`${config.wwwroot}/.foot`).toString()
-      : fs.existsSync("./foot.html")
+      : fs.existsSync(`${config.wwwroot}/foot.html`)
-        ? fs.readFileSync("./foot.html").toString()
+        ? fs.readFileSync(`${config.wwwroot}/foot.html`).toString()
         : ""; // footer
   } catch (err) {
     res.error(500, err);

src/index.js

@@ -812,7 +812,11 @@ if (!disableMods) {
   }
 
   // Determine path of server-side script file
-  let SSJSPath = "./serverSideScript.js";
+  let SSJSPath = `${
+    process.serverConfig.wwwroot != undefined
+      ? process.serverConfig.wwwroot
+      : process.dirname
+  }/serverSideScript.js`;
   if (!process.serverConfig.useWebRootServerSideScript)
     SSJSPath = process.dirname + "/serverSideScript.js";
 

src/middleware/checkForbiddenPaths.js

@@ -8,8 +8,12 @@ const {
 } = require("../utils/forbiddenPaths.js");
 const svrjsInfo = require("../../svrjs.json");
 const { name } = svrjsInfo;
+const wwwroot =
+  process.serverConfig && process.serverConfig.wwwroot !== undefined
+    ? process.serverConfig.wwwroot
+    : ".";
 
-forbiddenPaths.config = getInitializePath("./config.json");
+forbiddenPaths.config = getInitializePath(`${wwwroot}/config.json`);
 forbiddenPaths.certificates = [];
 if (process.serverConfig.secure) {
   forbiddenPaths.certificates.push(
@@ -26,7 +30,8 @@ if (process.serverConfig.secure) {
   });
 }
 forbiddenPaths.svrjs = getInitializePath(
-  "./" +
+  wwwroot +
+    "/" +
     (process.dirname[process.dirname.length - 1] != "/"
       ? process.filename.replace(process.dirname + "/", "")
       : process.filename.replace(process.dirname, ""))
@@ -36,16 +41,18 @@ if (process.serverConfig.useWebRootServerSideScript) {
   forbiddenPaths.serverSideScripts.push("/serverSideScript.js");
 } else {
   forbiddenPaths.serverSideScripts.push(
-    getInitializePath("./serverSideScript.js")
+    getInitializePath(`${wwwroot}/serverSideScript.js`)
   );
 }
 forbiddenPaths.serverSideScriptDirectories = [];
 forbiddenPaths.serverSideScriptDirectories.push(
-  getInitializePath("./node_modules")
+  getInitializePath(`${wwwroot}/node_modules`)
 );
-forbiddenPaths.serverSideScriptDirectories.push(getInitializePath("./mods"));
+forbiddenPaths.serverSideScriptDirectories.push(
-forbiddenPaths.temp = getInitializePath("./temp");
+  getInitializePath(wwwroot + "/mods")
-forbiddenPaths.log = getInitializePath("./log");
+);
+forbiddenPaths.temp = getInitializePath(`${wwwroot}/temp`);
+forbiddenPaths.log = getInitializePath(`${wwwroot}/log`);
 
 module.exports = (req, res, logFacilities, config, next) => {
   let decodedHrefWithoutDuplicateSlashes = "";

src/middleware/redirectTrailingSlashes.js

@@ -9,22 +9,25 @@ module.exports = (req, res, logFacilities, config, next) => {
     req.originalParsedURL.pathname[req.originalParsedURL.pathname.length - 1] !=
       "/"
   ) {
-    fs.stat("." + decodeURIComponent(req.parsedURL.pathname), (err, stats) => {
+    fs.stat(
-      if (err || !stats.isDirectory()) {
+      config.wwwroot + decodeURIComponent(req.parsedURL.pathname),
-        try {
+      (err, stats) => {
-          next();
+        if (err || !stats.isDirectory()) {
-        } catch (err) {
+          try {
-          res.error(500, err);
+            next();
+          } catch (err) {
+            res.error(500, err);
+          }
+        } else {
+          res.redirect(
+            req.originalParsedURL.pathname +
+              "/" +
+              (req.parsedURL.search ? req.parsedURL.search : "") +
+              (req.parsedURL.hash ? req.parsedURL.hash : "")
+          );
         }
-      } else {
-        res.redirect(
-          req.originalParsedURL.pathname +
-            "/" +
-            (req.parsedURL.search ? req.parsedURL.search : "") +
-            (req.parsedURL.hash ? req.parsedURL.hash : "")
-        );
       }
-    });
+    );
   } else {
     next();
   }

src/middleware/rewriteURL.js

@@ -28,7 +28,7 @@ module.exports = (req, res, logFacilities, config, next) => {
           !_fileState
         ) {
           fs.stat(
-            "." + decodeURIComponent(req.parsedURL.pathname),
+            config.wwwroot + decodeURIComponent(req.parsedURL.pathname),
             (err, stats) => {
               let _fileState = 3;
               if (err) {

src/middleware/staticFileServingAndDirectoryListings.js

@@ -86,7 +86,7 @@ module.exports = (req, res, logFacilities, config, next) => {
     res.error(400);
     return;
   }
-  let readFrom = "." + dHref;
+  let readFrom = config.wwwroot + dHref;
   let dirImagesMissing = false;
   fs.stat(readFrom, (err, stats) => {
     if (err) {
@@ -502,13 +502,16 @@ module.exports = (req, res, logFacilities, config, next) => {
 
           const getCustomDirListingHeader = (callback) => {
             fs.readFile(
-              ("." + dHref + "/.dirhead").replace(/\/+/g, "/"),
+              (config.wwwroot + dHref + "/.dirhead").replace(/\/+/g, "/"),
               (err, data) => {
                 if (err) {
                   if (err.code == "ENOENT" || err.code == "EISDIR") {
                     if (os.platform != "win32" || href != "/") {
                       fs.readFile(
-                        ("." + dHref + "/HEAD.html").replace(/\/+/g, "/"),
+                        (config.wwwroot + dHref + "/HEAD.html").replace(
+                          /\/+/g,
+                          "/"
+                        ),
                         (err, data) => {
                           if (err) {
                             if (err.code == "ENOENT" || err.code == "EISDIR") {
@@ -538,13 +541,16 @@ module.exports = (req, res, logFacilities, config, next) => {
 
           const getCustomDirListingFooter = (callback) => {
             fs.readFile(
-              ("." + dHref + "/.dirfoot").replace(/\/+/g, "/"),
+              (config.wwwroot + dHref + "/.dirfoot").replace(/\/+/g, "/"),
               (err, data) => {
                 if (err) {
                   if (err.code == "ENOENT" || err.code == "EISDIR") {
                     if (os.platform != "win32" || href != "/") {
                       fs.readFile(
-                        ("." + dHref + "/FOOT.html").replace(/\/+/g, "/"),
+                        (config.wwwroot + dHref + "/FOOT.html").replace(
+                          /\/+/g,
+                          "/"
+                        ),
                         (err, data) => {
                           if (err) {
                             if (err.code == "ENOENT" || err.code == "EISDIR") {
@@ -646,7 +652,7 @@ module.exports = (req, res, logFacilities, config, next) => {
 
               if (
                 fs.existsSync(
-                  "." +
+                  config.wwwroot +
                     decodeURIComponent(href) +
                     "/.maindesc".replace(/\/+/g, "/")
                 )
@@ -654,7 +660,7 @@ module.exports = (req, res, logFacilities, config, next) => {
                 htmlFoot =
                   "</table><hr/>" +
                   fs.readFileSync(
-                    "." +
+                    config.wwwroot +
                       decodeURIComponent(href) +
                       "/.maindesc".replace(/\/+/g, "/")
                   ) +