Skip to content

Commit

Permalink
Merge pull request nodeSolidServer#1778 from nodeSolidServer/fix/issu…
Browse files Browse the repository at this point in the history
…e#1692

Fix/issue#1692
  • Loading branch information
bourgeoa authored Apr 3, 2024
2 parents f5652f3 + 81d8dfd commit 0b6df62
Show file tree
Hide file tree
Showing 6 changed files with 168 additions and 347 deletions.
2 changes: 1 addition & 1 deletion .nvmrc
Original file line number Diff line number Diff line change
@@ -1 +1 @@
16.14.0
v18.19.0
36 changes: 29 additions & 7 deletions lib/ldp.js
Original file line number Diff line number Diff line change
Expand Up @@ -145,18 +145,26 @@ class LDP {

const ldp = this
debug.handlers('POST -- On parent: ' + containerPath)
// prepare slug
if (container) {
// Containers should not receive an extension
extension = ''
}
// pepare slug
if (slug) {
if (this.isAuxResource(slug, extension)) throw error(403, 'POST is not allowed for auxiliary resources')
slug = decodeURIComponent(slug)

if (container) {
// the name of a container cannot be a valid auxiliary resource document
while (this._containsInvalidSuffixes(slug + '/')) {
const idx = slug.lastIndexOf('.')
slug = slug.substr(0, idx)
}
} else if (this.isAuxResource(slug, extension)) throw error(403, 'POST to auxiliary resources is not allowed')

if (slug.match(/\/|\||:/)) {
throw error(400, 'The name of new file POSTed may not contain : | or /')
throw error(400, 'The name of a POSTed new file may not contain ":" (colon), "|" (pipe), or "/" (slash)')
}
}
// Containers should not receive an extension
if (container) {
extension = ''
}

// always return a valid URL.
const resourceUrl = await ldp.getAvailableUrl(hostname, containerPath, { slug, extension, container })
Expand Down Expand Up @@ -327,11 +335,25 @@ class LDP {
} catch (err) { }
}

/**
* This function is used to make sure a resource or container which contains
* reserved suffixes for auxiliary documents cannot be created.
* @param {string} path - the uri to check for invalid suffixes
* @returns {boolean} true is fail - if the path contains reserved suffixes
*/
_containsInvalidSuffixes (path) {
return AUXILIARY_RESOURCES.some(suffix => path.endsWith(suffix + '/'))
}

// check whether a document (or container) has the same name as another document (or container)
async checkItemName (url) {
let testName, testPath
const { hostname, pathname } = this.resourceMapper._parseUrl(url) // (url.url || url)
let itemUrl = this.resourceMapper.resolveUrl(hostname, pathname)
// make sure the resource being created does not attempt invalid resource creation
if (this._containsInvalidSuffixes(itemUrl)) {
throw error(400, `${itemUrl} contained reserved suffixes in path`)
}
const container = itemUrl.endsWith('/')
try {
const testUrl = container ? itemUrl.slice(0, -1) : itemUrl + '/'
Expand Down
Loading

0 comments on commit 0b6df62

Please sign in to comment.