wai-middleware-static 0.4.0.3 → 0.5.0.0

raw patch · 3 files changed

+32/−9 lines, 3 files

Files

• Network/Wai/Middleware/Static.hs +19/−6
• changelog.md +8/−0
• wai-middleware-static.cabal +5/−3

@@ -10,10 +10,10 @@ --   on the file extension and returns the file contents as the response. module Network.Wai.Middleware.Static     ( -- * Middlewares-      static, staticPolicy+      static, staticPolicy, unsafeStaticPolicy     , -- * Policies       Policy, (<|>), (>->), policy, predicate-    , addBase, addSlash, contains, hasPrefix, hasSuffix, noDots, only+    , addBase, addSlash, contains, hasPrefix, hasSuffix, noDots, isNotAbsolute, only     , -- * Utilities       tryPolicy     ) where@@ -83,20 +83,24 @@  -- | Accept only URIs with given suffix hasSuffix :: String -> Policy-hasSuffix suf = predicate (isSuffixOf suf)+hasSuffix = predicate . isSuffixOf  -- | Accept only URIs with given prefix hasPrefix :: String -> Policy-hasPrefix pre = predicate (isPrefixOf pre)+hasPrefix = predicate . isPrefixOf  -- | Accept only URIs containing given string contains :: String -> Policy-contains s = predicate (isInfixOf s)+contains = predicate . isInfixOf  -- | Reject URIs containing \"..\" noDots :: Policy noDots = predicate (not . isInfixOf "..") +-- | Reject URIs that are absolute paths+isNotAbsolute :: Policy+isNotAbsolute = predicate $ not . FP.isAbsolute+ -- | Use URI as the key to an association list, rejecting those not found. -- The policy result is the matching value. --@@ -110,12 +114,21 @@  -- | Serve static files out of the application root (current directory). -- If file is found, it is streamed to the client and no further middleware is run.+--+-- Note: for security reasons, this uses the 'noDots' and 'isNotAbsolute' policy by default. static :: Middleware static = staticPolicy mempty  -- | Serve static files subject to a 'Policy'+--+-- Note: for security reasons, this uses the 'noDots' and 'isNotAbsolute' policy by default. staticPolicy :: Policy -> Middleware-staticPolicy p app req =+staticPolicy p = unsafeStaticPolicy $ noDots >-> isNotAbsolute >-> p++-- | Serve static files subject to a 'Policy'. Unlike 'static' and 'staticPolicy', this +-- has no policies enabled by default, and is hence insecure.+unsafeStaticPolicy :: Policy -> Middleware+unsafeStaticPolicy p app req =     maybe (app req)           (\fp -> do exists <- liftIO $ doesFileExist fp                      if exists

@@ -0,0 +1,8 @@+## 0.5.0.0++* Add `isNotAbsolute` policy and change `static` and `staticPolicy` to +  use `noDots` and `isNotAbsolute` policies by default. (Thanks to Nick Hibberd!)++* Add `unsafeStaticPolicy`, which behaves as the old insecure `staticPolicy` behaved.++* Add changelog

@@ -1,13 +1,13 @@ Name:                wai-middleware-static-Version:             0.4.0.3-Synopsis:            WAI middleware that intercepts requests to static files.+Version:             0.5.0.0+Synopsis:            WAI middleware that serves requests to static files. Homepage:            https://github.com/scotty-web/scotty Bug-reports:         https://github.com/scotty-web/scotty/issues License:             BSD3 License-file:        LICENSE Author:              Andrew Farmer <afarmer@ittc.ku.edu> Maintainer:          Andrew Farmer <afarmer@ittc.ku.edu>-Copyright:           (c) 2012-2013 Andrew Farmer+Copyright:           (c) 2012-2014 Andrew Farmer Category:            Web Stability:           experimental Build-type:          Simple@@ -17,6 +17,8 @@   if they exist.   .   [WAI] <http://hackage.haskell.org/package/wai>++Extra-source-files:    changelog.md  Library   Exposed-modules:     Network.Wai.Middleware.Static