diff --git a/source/_posts/How-to-create-static-HTTP-server-in-Node-JS.md b/source/_posts/How-to-create-static-HTTP-server-in-Node-JS.md index 25d82ec..5a1f397 100644 --- a/source/_posts/How-to-create-static-HTTP-server-in-Node-JS.md +++ b/source/_posts/How-to-create-static-HTTP-server-in-Node-JS.md @@ -310,6 +310,7 @@ There is still one problem - the leak of "server.js" file. We can add a conditio var fs = require("fs"); var mime = require("mime-types"); var path = require("path"); + var os = require("os"); var port = 8080; var server = http.createServer(function (req, res) { var urlObject = new URL(req.url, "http://localhost"); @@ -327,7 +328,7 @@ There is still one problem - the leak of "server.js" file. We can add a conditio filename = filename.replace(/\\/g,"/").replace(/\/\.\.?(?=\/|$)/g,"/").replace(/\/+/g,"/"); //Poor mans URL sanitizer if(filename == "./") filename = "./index.html"; var ext = path.extname(filename).substr(1); //path.extname gives "." character, so we're using substr(1) method. - if(filename == "./" + path.basename(__filename)) { + if(filename == ("./" + path.basename(__filename)) || (os.platform() == "win32" && filename.toLowerCase() == ("./" + path.basename(__filename)).toLowerCase())) { //Prevent leakage of server source code res.writeHead(403, "Forbidden", { "Content-Type": "text/plain"