forked from svrjs/svrjs
Update to SVR.JS 3.12.2
This commit is contained in:
parent
d25f912c06
commit
27e62da887
4 changed files with 30 additions and 11 deletions
|
|
@ -1,7 +1,7 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>SVR.JS 3.12.1</title>
|
||||
<title>SVR.JS 3.12.2</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta charset="UTF-8" />
|
||||
<style>
|
||||
|
|
@ -12,7 +12,7 @@
|
|||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>Welcome to SVR.JS 3.12.1</h1>
|
||||
<h1>Welcome to SVR.JS 3.12.2</h1>
|
||||
<br/>
|
||||
<img src="/logo.png" style="width: 256px;" />
|
||||
<br/>
|
||||
|
|
@ -134,8 +134,9 @@
|
|||
</div>
|
||||
<p>Changes:</p>
|
||||
<ul>
|
||||
<li>Added client errors, server errors, and malformed HTTP request counts to SVR.JS status page.</li>
|
||||
<li>Fixed multiple XSS vulnerabilities.</li>
|
||||
<li>SVR.JS now refuses to start with misconfigured SNI in order to prevent ReDoS vulnerabilities.</li>
|
||||
<li>Add <i>Host</i> header pre-processing.</li>
|
||||
<li>Changed SNI regular expression generation function.</li>
|
||||
</ul>
|
||||
<br/>
|
||||
<a href="/tests.html">Tests</a><br/>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>SVR.JS 3.12.1 Licenses</title>
|
||||
<title>SVR.JS 3.12.2 Licenses</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta charset="UTF-8" />
|
||||
<style>
|
||||
|
|
@ -12,8 +12,8 @@
|
|||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>SVR.JS 3.12.1 Licenses</h1>
|
||||
<h2>SVR.JS 3.12.1</h2>
|
||||
<h1>SVR.JS 3.12.2 Licenses</h1>
|
||||
<h2>SVR.JS 3.12.2</h2>
|
||||
<div style="display: inline-block; text-align: left; border-width: 2px; border-style: solid; border-color: gray; padding: 8px;">
|
||||
MIT License<br/>
|
||||
<br/>
|
||||
|
|
@ -37,7 +37,7 @@
|
|||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE<br/>
|
||||
SOFTWARE.<br/>
|
||||
</div>
|
||||
<h2>Packages used by SVR.JS 3.12.1</h2>
|
||||
<h2>Packages used by SVR.JS 3.12.2</h2>
|
||||
<div style="width: 100%; background-color: #ccc; border: 1px solid green; text-align: left; margin: 10px 0;">
|
||||
<div style="float: right;">License: MIT</div>
|
||||
<div style="font-size: 20px;">
|
||||
|
|
|
|||
20
svr.js
20
svr.js
|
|
@ -80,7 +80,7 @@ function deleteFolderRecursive(path) {
|
|||
}
|
||||
|
||||
var os = require("os");
|
||||
var version = "3.12.1";
|
||||
var version = "3.12.2";
|
||||
var singlethreaded = false;
|
||||
|
||||
if (process.versions) process.versions.svrjs = version; // Inject SVR.JS into process.versions
|
||||
|
|
@ -1282,6 +1282,7 @@ if (!fs.existsSync(__dirname + "/config.json")) {
|
|||
}
|
||||
|
||||
var certificateError = null;
|
||||
var sniReDos = false;
|
||||
|
||||
// Load SNI
|
||||
if (secure) {
|
||||
|
|
@ -1291,6 +1292,9 @@ if (secure) {
|
|||
var sniNames = Object.keys(sni);
|
||||
var sniCredentials = [];
|
||||
sniNames.forEach(function (sniName) {
|
||||
if(typeof sniName === "string" && sniName.match(/\*[^*.:]*\*[^*.:]*(?:\.|:|$)/)) {
|
||||
sniReDos = true;
|
||||
}
|
||||
sniCredentials.push({
|
||||
name: sniName,
|
||||
cert: fs.readFileSync((sni[sniName].cert[0] != "/" && !sni[sniName].cert.match(/^[A-Z0-9]:\\/)) ? __dirname + "/" + sni[sniName].cert : sni[sniName].cert).toString(),
|
||||
|
|
@ -2111,6 +2115,11 @@ if (!cluster.isPrimary) {
|
|||
cert: sniCredentialsSingle.cert,
|
||||
key: sniCredentialsSingle.key
|
||||
});
|
||||
try {
|
||||
var snMatches = sniCredentialsSingle.name.match(/^([^:[]*|\[[^]]*\]?)((?::.*)?)$/);
|
||||
if(!snMatches[1][0].match(/^\.+$/)) snMatches[1][0] = snMatches[1][0].replace(/\.+$/,"");
|
||||
server._contexts[server._contexts.length-1][0] = new RegExp("^" + snMatches[1].replace(/([.^$+?\-\\[\]{}])/g, "\\$1").replace(/\*/g, "[^.:]*") + ((snMatches[1][0] == "[" || snMatches[1].match(/^(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/)) ? "" : "\.?") + snMatches[2].replace(/([.^$+?\-\\[\]{}])/g, "\\$1").replace(/\*/g, "[^.]*") + "$", "i");
|
||||
} catch(ex) {}
|
||||
});
|
||||
}
|
||||
server.on("request", reqhandler);
|
||||
|
|
@ -2955,9 +2964,17 @@ if (!cluster.isPrimary) {
|
|||
|
||||
reqcounter++;
|
||||
|
||||
// Process the Host header
|
||||
var oldHostHeader = req.headers.host;
|
||||
if (typeof req.headers.host == "string") {
|
||||
req.headers.host = req.headers.host.toLowerCase();
|
||||
if(!req.headers.host.match(/^\.+$/)) req.headers.host = req.headers.host.replace(/\.$/g,"");
|
||||
}
|
||||
|
||||
if (!isProxy) serverconsole.reqmessage("Client " + ((!reqip || reqip == "") ? "[unknown client]" : (reqip + ((reqport && reqport !== 0) && reqport != "" ? ":" + reqport : ""))) + " wants " + (req.method == "GET" ? "content in " : (req.method == "POST" ? "to post content in " : (req.method == "PUT" ? "to add content in " : (req.method == "DELETE" ? "to delete content in " : (req.method == "PATCH" ? "to patch content in " : "to access content using " + req.method + " method in "))))) + (req.headers.host == undefined ? "" : req.headers.host) + req.url);
|
||||
else serverconsole.reqmessage("Client " + ((!reqip || reqip == "") ? "[unknown client]" : (reqip + ((reqport && reqport !== 0) && reqport != "" ? ":" + reqport : ""))) + " wants " + (req.method == "GET" ? "content in " : (req.method == "POST" ? "to post content in " : (req.method == "PUT" ? "to add content in " : (req.method == "DELETE" ? "to delete content in " : (req.method == "PATCH" ? "to patch content in " : "to access content using " + req.method + " method in "))))) + req.url);
|
||||
if (req.headers["user-agent"] != undefined) serverconsole.reqmessage("Client uses " + req.headers["user-agent"]);
|
||||
if (oldHostHeader && oldHostHeader != req.headers.host) serverconsole.resmessage("Host name rewritten: " + oldHostHeader + " => " + req.headers.host);
|
||||
|
||||
var acceptEncoding = req.headers["accept-encoding"];
|
||||
if (!acceptEncoding) acceptEncoding = "";
|
||||
|
|
@ -4889,6 +4906,7 @@ function start(init) {
|
|||
}
|
||||
if (certificateError) throw new Error("There was a problem with SSL certificate/private key: " + certificateError.message);
|
||||
if (wwwrootError) throw new Error("There was a problem with your web root: " + wwwrootError.message);
|
||||
if (sniReDos) throw new Error("Refusing to start, because the current SNI configuration would make the server vulnerable to ReDoS.");
|
||||
}
|
||||
|
||||
// Information about starting the server
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>SVR.JS 3.12.1 Tests</title>
|
||||
<title>SVR.JS 3.12.2 Tests</title>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta charset="UTF-8" />
|
||||
<style>
|
||||
|
|
@ -12,7 +12,7 @@
|
|||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<h1>SVR.JS 3.12.1 Tests</h1>
|
||||
<h1>SVR.JS 3.12.2 Tests</h1>
|
||||
<h2>Directory (without trailing slash)</h2>
|
||||
<iframe src="/testdir" width="50%" height="300px"></iframe>
|
||||
<h2>Directory (with query)</h2>
|
||||
|
|
|
|||
Reference in a new issue