CVE-2018-3717

@@ -6,6 +6,7 @@ HEAD
  * compress: use compression
  * csrf: use csurf
  * dep: cookie-signature@1.0.3
+ * directory: use serve-index
  * errorHandler: use errorhandler
  * favicon: use static-favicon
  * logger: use morgan

@@ -23,6 +23,7 @@
  *  - [cookieParser](https://github.com/expressjs/cookie-parser) cookie parser
  *  - [compress](https://github.com/expressjs/compression) Gzip compression middleware
  *  - [csrf](https://github.com/expressjs/csurf) Cross-site request forgery protection
+ *  - [directory](https://github.com/expressjs/serve-index) directory listing middleware
  *  - [errorHandler](https://github.com/expressjs/errorhandler) flexible error handler
  *  - [favicon](https://github.com/expressjs/favicon) efficient favicon server (with default icon)
  *  - [logger](https://github.com/expressjs/morgan) request logger with custom format support
@@ -38,7 +39,6 @@
  *  - [cookieSession](cookieSession.html) cookie-based session support
  *  - [staticCache](staticCache.html) memory cache layer for the static() middleware
  *  - [static](static.html) streaming static file server supporting `Range` and more
- *  - [directory](directory.html) directory listing middleware
  *  - [limit](limit.html) limit the bytesize of request bodies
  *  - [query](query.html) automatic querystring parser, populating `req.query`
  *

@@ -6,338 +6,15 @@
  * MIT Licensed
  */
 
-// TODO: arrow key navigation
-// TODO: make icons extensible
-
-/**
- * Module dependencies.
- */
-
-var fs = require('fs')
-  , parse = require('url').parse
-  , utils = require('../utils')
-  , path = require('path')
-  , normalize = path.normalize
-  , sep = path.sep
-  , extname = path.extname
-  , join = path.join;
-var Batch = require('batch');
-var Negotiator = require('negotiator');
-
-/*!
- * Icon cache.
- */
-
-var cache = {};
-
-/*!
- * Default template.
- */
-
-var defaultTemplate = join(__dirname, '..', 'public', 'directory.html');
-
-/**
- * Media types and the map for content negotiation.
- */
-
-var mediaTypes = [
-  'text/html',
-  'text/plain',
-  'application/json'
-];
-
-var mediaType = {
-  'text/html': 'html',
-  'text/plain': 'plain',
-  'application/json': 'json'
-};
-
 /**
  * Directory:
  *
- * Serve directory listings with the given `root` path.
- *
- * Options:
- *
- *  - `hidden` display hidden (dot) files. Defaults to false.
- *  - `icons`  display icons. Defaults to false.
- *  - `filter` Apply this filter function to files. Defaults to false.
- *  - `template` Optional path to html template. Defaults to a built-in template.
- *    The following tokens are replaced:
- *      - `{directory}` with the name of the directory.
- *      - `{files}` with the HTML of an unordered list of file links.
- *      - `{linked-path}` with the HTML of a link to the directory.
- *      - `{style}` with the built-in CSS and embedded images.
+ * See [serve-index](https://github.com/expressjs/serve-index)
  *
  * @param {String} root
  * @param {Object} options
  * @return {Function}
  * @api public
  */
 
-exports = module.exports = function directory(root, options){
-  options = options || {};
-
-  // root required
-  if (!root) throw new Error('directory() root path required');
-  var hidden = options.hidden
-    , icons = options.icons
-    , view = options.view || 'tiles'
-    , filter = options.filter
-    , root = normalize(root + sep)
-    , template = options.template || defaultTemplate;
-
-  return function directory(req, res, next) {
-    if ('GET' != req.method && 'HEAD' != req.method) return next();
-
-    var url = parse(req.url)
-      , dir = decodeURIComponent(url.pathname)
-      , path = normalize(join(root, dir))
-      , originalUrl = parse(req.originalUrl)
-      , originalDir = decodeURIComponent(originalUrl.pathname)
-      , showUp = path != root;
-
-    // null byte(s), bad request
-    if (~path.indexOf('\0')) return next(utils.error(400));
-
-    // malicious path, forbidden
-    if (0 != path.indexOf(root)) return next(utils.error(403));
-
-    // check if we have a directory
-    fs.stat(path, function(err, stat){
-      if (err) return 'ENOENT' == err.code
-        ? next()
-        : next(err);
-
-      if (!stat.isDirectory()) return next();
-
-      // fetch files
-      fs.readdir(path, function(err, files){
-        if (err) return next(err);
-        if (!hidden) files = removeHidden(files);
-        if (filter) files = files.filter(filter);
-        files.sort();
-
-        // content-negotiation
-        var type = new Negotiator(req).preferredMediaType(mediaTypes);
-
-        // not acceptable
-        if (!type) return next(utils.error(406));
-        exports[mediaType[type]](req, res, files, next, originalDir, showUp, icons, path, view, template);
-      });
-    });
-  };
-};
-
-/**
- * Respond with text/html.
- */
-
-exports.html = function(req, res, files, next, dir, showUp, icons, path, view, template){
-  fs.readFile(template, 'utf8', function(err, str){
-    if (err) return next(err);
-    fs.readFile(__dirname + '/../public/style.css', 'utf8', function(err, style){
-      if (err) return next(err);
-      stat(path, files, function(err, stats){
-        if (err) return next(err);
-        files = files.map(function(file, i){ return { name: file, stat: stats[i] }; });
-        files.sort(fileSort);
-        if (showUp) files.unshift({ name: '..' });
-        str = str
-          .replace('{style}', style.concat(iconStyle(files, icons)))
-          .replace('{files}', html(files, dir, icons, view))
-          .replace('{directory}', dir)
-          .replace('{linked-path}', htmlPath(dir));
-        res.setHeader('Content-Type', 'text/html');
-        res.setHeader('Content-Length', str.length);
-        res.end(str);
-      });
-    });
-  });
-};
-
-/**
- * Respond with application/json.
- */
-
-exports.json = function(req, res, files){
-  files = JSON.stringify(files);
-  res.setHeader('Content-Type', 'application/json');
-  res.setHeader('Content-Length', files.length);
-  res.end(files);
-};
-
-/**
- * Respond with text/plain.
- */
-
-exports.plain = function(req, res, files){
-  files = files.join('\n') + '\n';
-  res.setHeader('Content-Type', 'text/plain');
-  res.setHeader('Content-Length', files.length);
-  res.end(files);
-};
-
-/**
- * Sort function for with directories first.
- */
-
-function fileSort(a, b) {
-  return Number(b.stat && b.stat.isDirectory()) - Number(a.stat && a.stat.isDirectory()) ||
-    String(a.name).toLocaleLowerCase().localeCompare(String(b.name).toLocaleLowerCase());
-}
-
-/**
- * Map html `dir`, returning a linked path.
- */
-
-function htmlPath(dir) {
-  var curr = [];
-  return dir.split('/').map(function(part){
-    curr.push(encodeURIComponent(part));
-    return part ? '<a href="' + curr.join('/') + '">' + part + '</a>' : '';
-  }).join(' / ');
-}
-
-/**
- * Load icon images, return css string.
- */
-
-function iconStyle (files, useIcons) {
-  if (!useIcons) return '';
-  var data = {};
-  var views = { tiles: [], details: [], mobile: [] };
-
-  for (var i=0; i < files.length; i++) {
-    var file = files[i];
-    if (file.name == '..') continue;
-
-    var isDir = '..' == file.name || (file.stat && file.stat.isDirectory());
-    var icon = isDir ? icons.folder : icons[extname(file.name)] || icons.default;
-
-    var ext = extname(file.name);
-    ext = isDir ? '.directory' : (icons[ext] ? ext : '.default');
-
-    if (data[icon]) continue;
-    data[icon] = ext + ' .name{background-image: url(data:image/png;base64,' + load(icon)+');}';
-    views.tiles.push('.view-tiles ' + data[icon]);
-  	views.details.push('.view-details ' + data[icon]);
-  	views.mobile.push('#files ' + data[icon]);
-  }
-
-  var style = views.tiles.join('\n')
-    + '\n'+views.details.join('\n')
-    + '\n@media (max-width: 768px) {\n\t'
-    + views.mobile.join('\n\t')
-    + '\n}';
-  return style;
-}
-
-/**
- * Map html `files`, returning an html unordered list.
- */
-
-function html(files, dir, useIcons, view) {
-  	return '<ul id="files" class="view-'+view+'">'
-    + (view == 'details' ? (
-      '<li class="header">'
-      + '<span class="name">Name</span>'
-      + '<span class="size">Size</span>'
-      + '<span class="date">Modified</span>'
-      + '</li>') : '')
-    + files.map(function(file){
-    var isDir
-      , classes = []
-      , path = dir.split('/').map(function (c) { return encodeURIComponent(c); });
-
-    if (useIcons) {
-      var ext = extname(file.name);
-      isDir = '..' == file.name || (file.stat && file.stat.isDirectory());
-      ext = isDir ? '.directory' : (icons[ext] ? ext : '.default');
-      classes.push('icon');
-      classes.push(ext.replace('.',''));
-    }
-
-    path.push(encodeURIComponent(file.name));
-
-    var date = file.name == '..' ? ''
-      : file.stat.mtime.toDateString()+' '+file.stat.mtime.toLocaleTimeString();
-    var size = file.name == '..' ? '' : file.stat.size;
-
-    return '<li><a href="'
-      + utils.normalizeSlashes(normalize(path.join('/')))
-      + '" class="'
-      + classes.join(' ') + '"'
-      + ' title="' + file.name + '">'
-      + '<span class="name">'+file.name+'</span>'
-      + '<span class="size">'+size+'</span>'
-      + '<span class="date">'+date+'</span>'
-      + '</a></li>';
-
-  }).join('\n') + '</ul>';
-}
-
-/**
- * Load and cache the given `icon`.
- *
- * @param {String} icon
- * @return {String}
- * @api private
- */
-
-function load(icon) {
-  if (cache[icon]) return cache[icon];
-  return cache[icon] = fs.readFileSync(__dirname + '/../public/icons/' + icon, 'base64');
-}
-
-/**
- * Filter "hidden" `files`, aka files
- * beginning with a `.`.
- *
- * @param {Array} files
- * @return {Array}
- * @api private
- */
-
-function removeHidden(files) {
-  return files.filter(function(file){
-    return '.' != file[0];
-  });
-}
-
-/**
- * Stat all files and return array of stat
- * in same order.
- */
-
-function stat(dir, files, cb) {
-  var batch = new Batch();
-
-  batch.concurrency(10);
-
-  files.forEach(function(file, i){
-    batch.push(function(done){
-      fs.stat(join(dir, file), done);
-    });
-  });
-
-  batch.end(cb);
-}
-
-/**
- * Icon map.
- */
-
-var icons = {
-    '.js': 'page_white_code_red.png'
-  , '.c': 'page_white_c.png'
-  , '.h': 'page_white_h.png'
-  , '.cc': 'page_white_cplusplus.png'
-  , '.php': 'page_white_php.png'
-  , '.rb': 'page_white_ruby.png'
-  , '.cpp': 'page_white_cplusplus.png'
-  , '.swf': 'page_white_flash.png'
-  , '.pdf': 'page_white_acrobat.png'
-  , 'folder': 'folder.png'
-  , 'default': 'page_white.png'
-};
+module.exports = require('serve-index');

@@ -1,82 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <meta charset='utf-8'> 
-    <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" />
-    <title>listing directory {directory}</title>
-    <style>{style}</style>
-    <script>
-      function $(id){
-        var el = 'string' == typeof id
-          ? document.getElementById(id)
-          : id;
-
-        el.on = function(event, fn){
-          if ('content loaded' == event) {
-            event = window.attachEvent ? "load" : "DOMContentLoaded";
-          }
-          el.addEventListener
-            ? el.addEventListener(event, fn, false)
-            : el.attachEvent("on" + event, fn);
-        };
-
-        el.all = function(selector){
-          return $(el.querySelectorAll(selector));
-        };
-
-        el.each = function(fn){
-          for (var i = 0, len = el.length; i < len; ++i) {
-            fn($(el[i]), i);
-          }
-        };
-
-        el.getClasses = function(){
-          return this.getAttribute('class').split(/\s+/);
-        };
-
-        el.addClass = function(name){
-          var classes = this.getAttribute('class');
-          el.setAttribute('class', classes
-            ? classes + ' ' + name
-            : name);
-        };
-
-        el.removeClass = function(name){
-          var classes = this.getClasses().filter(function(curr){
-            return curr != name;
-          });
-          this.setAttribute('class', classes.join(' '));
-        };
-
-        return el;
-      }
-
-      function search() {
-        var str = $('search').value
-          , links = $('files').all('a');
-
-        links.each(function(link){
-          var text = link.textContent;
-
-          if ('..' == text) return;
-          if (str.length && ~text.indexOf(str)) {
-            link.addClass('highlight');
-          } else {
-            link.removeClass('highlight');
-          }
-        });
-      }
-
-      $(window).on('content loaded', function(){
-        $('search').on('keyup', search);
-      });
-    </script>
-  </head>
-  <body class="directory">
-    <input id="search" type="text" placeholder="Search" autocomplete="off" />
-    <div id="wrapper">
-      <h1>{linked-path}</h1>
-      {files}
-    </div>
-  </body>
-</html>
\ No newline at end of file

@@ -1,257 +0,0 @@
-* {
-  margin: 0;
-  padding: 0;
-  outline: 0;
-}
-
-body {
-  padding: 80px 100px;
-  font: 13px "Helvetica Neue", "Lucida Grande", "Arial";
-  background: #ECE9E9 -webkit-gradient(linear, 0% 0%, 0% 100%, from(#fff), to(#ECE9E9));
-  background: #ECE9E9 -moz-linear-gradient(top, #fff, #ECE9E9);
-  background-repeat: no-repeat;
-  color: #555;
-  -webkit-font-smoothing: antialiased;
-}
-h1, h2, h3 {
-  font-size: 22px;
-  color: #343434;
-}
-h1 em, h2 em {
-  padding: 0 5px;
-  font-weight: normal;
-}
-h1 {
-  font-size: 60px;
-}
-h2 {
-  margin-top: 10px;
-}
-h3 {
-  margin: 5px 0 10px 0;
-  padding-bottom: 5px;
-  border-bottom: 1px solid #eee;
-  font-size: 18px;
-}
-ul li {
-  list-style: none;
-}
-ul li:hover {
-  cursor: pointer;
-  color: #2e2e2e;
-}
-ul li .path {
-  padding-left: 5px;
-  font-weight: bold;
-}
-ul li .line {
-  padding-right: 5px;
-  font-style: italic;
-}
-ul li:first-child .path {
-  padding-left: 0;
-}
-p {
-  line-height: 1.5;
-}
-a {
-  color: #555;
-  text-decoration: none;
-}
-a:hover {
-  color: #303030;
-}
-#stacktrace {
-  margin-top: 15px;
-}
-.directory h1 {
-  margin-bottom: 15px;
-  font-size: 18px;
-}
-ul#files {
-  width: 100%;
-  height: 100%;
-  overflow: hidden;
-}
-ul#files li {
-  float: left;
-  width: 30%;
-  line-height: 25px;
-  margin: 1px;
-}
-ul#files li a {
-  display: block;
-  height: 25px;
-  border: 1px solid transparent;
-  -webkit-border-radius: 5px;
-  -moz-border-radius: 5px;
-  border-radius: 5px;
-  overflow: hidden;
-  white-space: nowrap;
-}
-ul#files li a:focus,
-ul#files li a:hover {
-  background: rgba(255,255,255,0.65);
-  border: 1px solid #ececec;
-}
-ul#files li a.highlight {
-  -webkit-transition: background .4s ease-in-out;
-  background: #ffff4f;
-  border-color: #E9DC51;
-}
-#search {
-  display: block;
-  position: fixed;
-  top: 20px;
-  right: 20px;
-  width: 90px;
-  -webkit-transition: width ease 0.2s, opacity ease 0.4s;
-  -moz-transition: width ease 0.2s, opacity ease 0.4s;
-  -webkit-border-radius: 32px;
-  -moz-border-radius: 32px;
-  -webkit-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03);
-  -moz-box-shadow: inset 0px 0px 3px rgba(0, 0, 0, 0.25), inset 0px 1px 3px rgba(0, 0, 0, 0.7), 0px 1px 0px rgba(255, 255, 255, 0.03);
-  -webkit-font-smoothing: antialiased;
-  text-align: left;
-  font: 13px "Helvetica Neue", Arial, sans-serif;
-  padding: 4px 10px;
-  border: none;
-  background: transparent;
-  margin-bottom: 0;
-  outline: none;
-  opacity: 0.7;
-  color: #888;
-}
-#search:focus {
-  width: 120px;
-  opacity: 1.0; 
-}
-
-/*views*/
-#files span {
-  display: inline-block;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  text-indent: 10px;
-}
-#files .name {
-  background-repeat: no-repeat;
-}
-#files .icon .name {
-  text-indent: 28px;
-}
-
-/*tiles*/
-.view-tiles .name {
-  width: 100%;
-  background-position: 8px 5px;
-}
-.view-tiles .size,
-.view-tiles .date {
-  display: none;
-}
-
-/*details*/
-ul#files.view-details li {
-  float: none;
-  display: block;
-  width: 90%;
-}
-ul#files.view-details li.header {
-  height: 25px;
-  background: #000;
-  color: #fff;
-  font-weight: bold;
-}
-.view-details .header {
-  border-radius: 5px;
-}
-.view-details .name {
-  width: 60%;
-  background-position: 8px 5px;
-}
-.view-details .size {
-  width: 10%;
-}
-.view-details .date {
-  width: 30%;
-}
-.view-details .size,
-.view-details .date {
-  text-align: right;
-  direction: rtl;
-}
-
-/*mobile*/
-@media (max-width: 768px) {
-  body {
-    font-size: 13px;
-    line-height: 16px;
-    padding: 0;
-  }
-  #search {
-    position: static;
-    width: 100%;
-    font-size: 2em;
-    line-height: 1.8em;
-    text-indent: 10px;
-    border: 0;
-    border-radius: 0;
-    padding: 10px 0;
-    margin: 0;
-  }
-  #search:focus {
-    width: 100%;
-    border: 0;
-    opacity: 1;
-  }
-  .directory h1 {
-    font-size: 2em;
-    line-height: 1.5em;
-    color: #fff;
-    background: #000;
-    padding: 15px 10px;
-    margin: 0;
-  }
-  ul#files {
-    border-top: 1px solid #cacaca;
-  }
-  ul#files li {
-    float: none;
-    width: auto !important;
-    display: block;
-    border-bottom: 1px solid #cacaca;
-    font-size: 2em;
-    line-height: 1.2em;
-    text-indent: 0;
-    margin: 0;
-  }
-  ul#files li:nth-child(odd) {
-    background: #e0e0e0;
-  }
-  ul#files li a {
-    height: auto;
-    border: 0;
-    border-radius: 0;
-    padding: 15px 10px;
-  }
-  ul#files li a:focus,
-  ul#files li a:hover {
-    border: 0;
-  }
-  #files .header,
-  #files .size,
-  #files .date {
-    display: none !important;
-  }
-  #files .name {
-    float: none;
-    display: inline-block;
-    width: 100%;
-    text-indent: 0;
-    background-position: 0 0;
-  }
-  #files .icon .name {
-    text-indent: 41px;
-  }
-}

@@ -13,7 +13,6 @@
   "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",
   "dependencies": {
     "basic-auth-connect": "1.0.0",
-    "batch": "0.5.0",
     "cookie-parser": "1.0.1",
     "cookie-signature": "1.0.3",
     "compression": "1.0.0",
@@ -25,6 +24,7 @@
     "morgan": "1.0.0",
     "qs": "0.6.6",
     "response-time": "1.0.0",
+    "serve-index": "1.0.0",
     "static-favicon": "1.0.0",
     "vhost": "1.0.0",
     "send": "0.1.4",
@@ -33,7 +33,6 @@
     "pause": "0.0.1",
     "debug": ">= 0.7.3 < 1",
     "raw-body": "1.1.3",
-    "negotiator": "0.3.0",
     "multiparty": "2.2.0"
   },
   "devDependencies": {