ullun-api 0.2.3

Express.js-inspired web framework for Rust - simple, fast, batteries-included
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

//! Static file serving

use crate::error::{Error, Result};
use crate::handler::Handler;
use crate::request::Request;
use crate::response::Response;
use async_trait::async_trait;
use std::path::{Path, PathBuf};
use tokio::fs;

pub struct StaticFileHandler {
    root_dir: PathBuf,
}

impl StaticFileHandler {
    pub fn new(root_dir: &str) -> Self {
        Self {
            root_dir: PathBuf::from(root_dir),
        }
    }

    async fn serve_file(&self, file_path: &str) -> Result<Response> {
        // Sanitize path to prevent directory traversal
        let file_path = file_path.trim_start_matches('/');
        let full_path = self.root_dir.join(file_path);

        // Ensure the path is within root_dir
        let canonical_root = fs::canonicalize(&self.root_dir)
            .await
            .map_err(|_| Error::not_found("Static directory not found"))?;

        // Canonicalize and validate path (prevents TOCTOU race)
        let canonical_path = fs::canonicalize(&full_path)
            .await
            .map_err(|_| Error::not_found("File not found"))?;

        if !canonical_path.starts_with(&canonical_root) {
            // 404 instead of 403: do not reveal whether the target exists
            return Err(Error::not_found("File not found"));
        }

        // Check if it's a directory
        let metadata = fs::metadata(&canonical_path)
            .await
            .map_err(|_| Error::not_found("File not found"))?;

        if metadata.is_dir() {
            // Try to serve index.html
            let index_path = canonical_path.join("index.html");
            if fs::metadata(&index_path).await.is_ok() {
                return self.serve_file_content(&index_path).await;
            }
            return Err(Error::forbidden("Directory listing not allowed"));
        }

        self.serve_file_content(&canonical_path).await
    }

    async fn serve_file_content(&self, path: &Path) -> Result<Response> {
        let content = fs::read(path)
            .await
            .map_err(|_| Error::internal("Failed to read file"))?;

        let content_type = guess_content_type(path);

        Ok(Response::new(http::StatusCode::OK)
            .with_header("content-type", content_type)
            .with_header("cache-control", "public, max-age=3600")
            .with_body(content))
    }
}

#[async_trait]
impl Handler for StaticFileHandler {
    async fn call(&self, req: Request) -> Result<Response> {
        let filepath = req.params.get("filepath").unwrap_or("");
        self.serve_file(filepath).await
    }
}

fn guess_content_type(path: &Path) -> &'static str {
    match path.extension().and_then(|e| e.to_str()) {
        Some("html") => "text/html; charset=utf-8",
        Some("css") => "text/css; charset=utf-8",
        Some("js") => "application/javascript; charset=utf-8",
        Some("json") => "application/json",
        Some("png") => "image/png",
        Some("jpg") | Some("jpeg") => "image/jpeg",
        Some("gif") => "image/gif",
        Some("svg") => "image/svg+xml",
        Some("ico") => "image/x-icon",
        Some("woff") => "font/woff",
        Some("woff2") => "font/woff2",
        Some("ttf") => "font/ttf",
        Some("txt") => "text/plain; charset=utf-8",
        Some("xml") => "application/xml",
        Some("pdf") => "application/pdf",
        Some("zip") => "application/zip",
        _ => "application/octet-stream",
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_content_type_detection() {
        assert_eq!(
            guess_content_type(Path::new("test.html")),
            "text/html; charset=utf-8"
        );
        assert_eq!(
            guess_content_type(Path::new("test.css")),
            "text/css; charset=utf-8"
        );
        assert_eq!(
            guess_content_type(Path::new("test.js")),
            "application/javascript; charset=utf-8"
        );
        assert_eq!(
            guess_content_type(Path::new("test.json")),
            "application/json"
        );
        assert_eq!(guess_content_type(Path::new("test.png")), "image/png");
        assert_eq!(
            guess_content_type(Path::new("unknown")),
            "application/octet-stream"
        );
    }
}