From 71b5727b6c339e0e59a3ccce1611fb48770526ed Mon Sep 17 00:00:00 2001
From: Dorian Niemiec <dorian.niemiec@svrjs.org>
Date: Sat, 2 Sep 2023 09:39:46 +0200
Subject: [PATCH] Update to SVR.JS 3.8.1

---
 config.json         | 21 +++++++++++++++------
 index.html          | 32 ++++++++++++++++++--------------
 licenses/index.html |  8 ++++----
 svr.js              |  6 +++---
 tests.html          |  4 ++--
 5 files changed, 42 insertions(+), 29 deletions(-)
diff --git a/config.json b/config.json
index 3791a3a..f534a00 100644
--- a/config.json
+++ b/config.json
@@ -16,10 +16,19 @@
   "stackHidden": false,
   "enableRemoteLogBrowsing": true,
   "exposeServerVersion": true,
-  "disableServerSideScriptExpose": false,
+  "disableServerSideScriptExpose": true,
   "rewriteMap": [
     {
-      "definingRegex": "/\\/invoke500\\/\\?/",
+      "definingRegex": "/^\\/serverSideScript\\.js(?:$|[#?])/",
+      "replacements": [
+        {
+          "regex": "/^\\/serverSideScript\\.js($|[#?])/",
+          "replacement": "/NONEXISTENT_PAGE$1"
+        }
+      ]
+    },
+    {
+      "definingRegex": "/^\\/invoke500\\/\\?/",
       "replacements": [
         {
           "regex": "/\\/invoke500\\/\\?/",
@@ -28,7 +37,7 @@
       ]
     },
     {
-      "definingRegex": "/\\/invoke500\\/.+\\//",
+      "definingRegex": "/^\\/invoke500\\/.+\\//",
       "replacements": [
         {
           "regex": "/\\/\\?/",
@@ -45,7 +54,7 @@
       ]
     },
     {
-      "definingRegex": "/\\/invoke500\\/.+/",
+      "definingRegex": "/^\\/invoke500\\/.+/",
       "replacements": [
         {
           "regex": "/\\?/",
@@ -58,7 +67,7 @@
       ]
     },
     {
-      "definingRegex": "/\\/invoke500\\//",
+      "definingRegex": "/^\\/invoke500\\//",
       "replacements": [
         {
           "regex": "/\\/invoke500\\//",
@@ -67,7 +76,7 @@
       ]
     },
     {
-      "definingRegex": "/\\/invoke500$/",
+      "definingRegex": "/^\\/invoke500$/",
       "replacements": [
         {
           "regex": "/\\/invoke500/",
diff --git a/index.html b/index.html
index a621d7f..3ab3848 100644
--- a/index.html
+++ b/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>SVR.JS 3.8.0</title>
+    <title>SVR.JS 3.8.1</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta charset="UTF-8" />
     <style>
@@ -12,7 +12,7 @@
     </style>
   </head>
   <body>
-    <h1>Welcome to SVR.JS 3.8.0</h1>
+    <h1>Welcome to SVR.JS 3.8.1</h1>
     <br/>
     <img src="/logo.png" style="width: 256px;" />
     <br/>
@@ -40,8 +40,16 @@
         &nbsp;&nbsp;"exposeServerVersion": true,<br/>
         &nbsp;&nbsp;"disableServerSideScriptExpose": false,<br/>
         &nbsp;&nbsp;"rewriteMap": [<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/^\\/serverSideScript\\.js(?:$|[#?])/",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacements": [<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"regex": "/^\\/serverSideScript\\.js($|[#?])/",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacement": "/NONEXISTENT_PAGE$1"<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;},<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;{<br/>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/\\/invoke500\\/\\?/",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/^\\/invoke500\\/\\?/",<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacements": [<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"regex": "/\\/invoke500\\/\\?/",<br/>
@@ -50,7 +58,7 @@
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;},<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;{<br/>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/\\/invoke500\\/.+\\//",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/^\\/invoke500\\/.+\\//",<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacements": [<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"regex": "/\\/\\?/",<br/>
@@ -67,7 +75,7 @@
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;},<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;{<br/>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/\\/invoke500\\/.+/",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/^\\/invoke500\\/.+/",<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacements": [<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"regex": "/\\?/",<br/>
@@ -80,7 +88,7 @@
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;},<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;{<br/>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/\\/invoke500\\//",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/^\\/invoke500\\//",<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacements": [<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"regex": "/\\/invoke500\\//",<br/>
@@ -89,15 +97,14 @@
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;},<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;{<br/>
-        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/\\/invoke500$/",<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"definingRegex": "/^\\/invoke500$/",<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacements": [<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;{<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"regex": "/\\/invoke500/",<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"replacement": "/invoke500.svr"<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}<br/>
         &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;]<br/>
-        &nbsp;&nbsp;&nbsp;&nbsp;}<br/>
-        &nbsp;&nbsp;],<br/>
+        &nbsp;&nbsp;&nbsp;&nbsp;}<br/>        &nbsp;&nbsp;],<br/>
         &nbsp;&nbsp;"allowStatus": true,<br/>
         &nbsp;&nbsp;"dontCompress": ["/.*\\.ipxe$/","/.*\\.img$/","/.*\\.iso$/"],<br/>
         &nbsp;&nbsp;"enableIPSpoofing": false,<br/>
@@ -110,11 +117,8 @@
     </div>
     <p>Changes:</p>
     <ul>
-      <li>Added partial virtual hosting support</li>
-      <li>Added <i>host</i> field to <i>nonStandardCodes</i> and <i>rewriteMap</i> properties.</li>
-      <li>Added <i>userList</i> field to <i>nonStandardCodes</i> properties (with <i>scode</i> set to 401).</li>
-      <li>Added new config.json properties: <i>errorPages</i>, <i>enableDirectoryListingVHost</i> and <i>customHeadersVHost</i>.</li>
-      <li>Improved HTTP authentication error handling.</li>
+      <li>Changed default SVR.JS configuration.</li>
+      <li>Disabled server-side script exposure by default.</li>
     </ul>
     <p>Bugs:</p>
     <ul>
diff --git a/licenses/index.html b/licenses/index.html
index fa3a490..2c5c339 100644
--- a/licenses/index.html
+++ b/licenses/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>SVR.JS 3.8.0 Licenses</title>
+    <title>SVR.JS 3.8.1 Licenses</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta charset="UTF-8" />
     <style>
@@ -12,8 +12,8 @@
     </style>
   </head>
   <body>
-    <h1>SVR.JS 3.8.0 Licenses</h1>
-    <h2>SVR.JS 3.8.0</h2>
+    <h1>SVR.JS 3.8.1 Licenses</h1>
+    <h2>SVR.JS 3.8.1</h2>
     <div style="display: inline-block; text-align: left; border-width: 2px; border-style: solid; border-color: gray; padding: 8px;">
       MIT License<br/>
       <br/>
@@ -37,7 +37,7 @@
       OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE<br/>
       SOFTWARE.<br/>
     </div>
-    <h2>Packages used by SVR.JS 3.8.0 and utilities</h2>
+    <h2>Packages used by SVR.JS 3.8.1 and utilities</h2>
     <div style="width: 100%; background-color: #ccc; border: 1px solid green; text-align: left; margin: 10px 0;">
       <div style="float: right;">License: MIT</div>
       <div style="font-size: 20px;">
diff --git a/svr.js b/svr.js
index 773000f..b867f30 100644
--- a/svr.js
+++ b/svr.js
@@ -81,7 +81,7 @@ function deleteFolderRecursive(path) {
 }
 
 var os = require("os");
-var version = "3.8.0";
+var version = "3.8.1";
 var singlethreaded = false;
 
 if (process.versions) process.versions.svrjs = version; //Inject SVR.JS into process.versions
@@ -4643,7 +4643,7 @@ if (!cluster.isPrimary) {
           callServerError(403);
           serverconsole.errmessage("Access to SVR.JS script is denied.");
           return;
-        } else if ((isForbiddenPath(decodedHref, "svrjs") || isForbiddenPath(decodedHref, "serverSideScripts") || isIndexOfForbiddenPath(decodedHref, "serverSideScriptDirectories")) && !isProxy && (configJSON.disableServerSideScriptExpose && configJSON.disableServerSideScriptExpose != undefined)) {
+        } else if ((isForbiddenPath(decodedHref, "svrjs") || isForbiddenPath(decodedHref, "serverSideScripts") || isIndexOfForbiddenPath(decodedHref, "serverSideScriptDirectories")) && !isProxy && (configJSON.disableServerSideScriptExpose || configJSON.disableServerSideScriptExpose === undefined)) {
           callServerError(403);
           serverconsole.errmessage("Access to sources is denied.");
           return;
@@ -5789,7 +5789,7 @@ function saveConfig() {
       if (configJSONobj.stackHidden === undefined) configJSONobj.stackHidden = false;
       if (configJSONobj.enableRemoteLogBrowsing === undefined) configJSONobj.enableRemoteLogBrowsing = true;
       if (configJSONobj.exposeServerVersion === undefined) configJSONobj.exposeServerVersion = true;
-      if (configJSONobj.disableServerSideScriptExpose === undefined) configJSONobj.disableServerSideScriptExpose = false;
+      if (configJSONobj.disableServerSideScriptExpose === undefined) configJSONobj.disableServerSideScriptExpose = true;
       if (configJSONobj.allowStatus === undefined) configJSONobj.allowStatus = true;
       if (configJSONobj.rewriteMap === undefined) configJSONobj.rewriteMap = [];
       if (configJSONobj.dontCompress === undefined) configJSONobj.dontCompress = [];
diff --git a/tests.html b/tests.html
index 1996bfc..4e58628 100644
--- a/tests.html
+++ b/tests.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html>
   <head>
-    <title>SVR.JS 3.8.0 Tests</title>
+    <title>SVR.JS 3.8.1 Tests</title>
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta charset="UTF-8" />
     <style>
@@ -12,7 +12,7 @@
     </style>
   </head>
   <body>
-    <h1>SVR.JS 3.8.0 Tests</h1>
+    <h1>SVR.JS 3.8.1 Tests</h1>
     <h2>Directory</h2>
     <iframe src="/testdir" width="50%" height="300px"></iframe>
     <h2>Directory (with query)</h2>
