caddy/caddyhttp/staticfiles/fileserver.go
Matthew Holt 5f135a27d5
Eliminate ineffectual assignments
Most of these were fixed by handling errors that were previously
unhandled (oops).
2016-09-05 10:30:46 -06:00

171 lines
4.6 KiB
Go

package staticfiles
import (
"fmt"
"math/rand"
"net/http"
"os"
"path"
"path/filepath"
"runtime"
"strconv"
"strings"
)
// FileServer implements a production-ready file server
// and is the 'default' handler for all requests to Caddy.
// It simply loads and serves the URI requested. FileServer
// is adapted from the one in net/http by the Go authors.
// Significant modifications have been made.
//
// Original license:
//
// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
type FileServer struct {
// Jailed disk access
Root http.FileSystem
// List of files to treat as "Not Found"
Hide []string
}
// ServeHTTP serves static files for r according to fs's configuration.
func (fs FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) (int, error) {
// r.URL.Path has already been cleaned by Caddy.
if r.URL.Path == "" {
r.URL.Path = "/"
}
return fs.serveFile(w, r, r.URL.Path)
}
// serveFile writes the specified file to the HTTP response.
// name is '/'-separated, not filepath.Separator.
func (fs FileServer) serveFile(w http.ResponseWriter, r *http.Request, name string) (int, error) {
// Prevent absolute path access on Windows.
// TODO remove when stdlib http.Dir fixes this.
if runtime.GOOS == "windows" {
if filepath.IsAbs(name[1:]) {
return http.StatusNotFound, nil
}
}
f, err := fs.Root.Open(name)
if err != nil {
if os.IsNotExist(err) {
return http.StatusNotFound, nil
} else if os.IsPermission(err) {
return http.StatusForbidden, err
}
// Likely the server is under load and ran out of file descriptors
backoff := int(3 + rand.Int31()%3) // 3–5 seconds to prevent a stampede
w.Header().Set("Retry-After", strconv.Itoa(backoff))
return http.StatusServiceUnavailable, err
}
defer f.Close()
d, err := f.Stat()
if err != nil {
if os.IsNotExist(err) {
return http.StatusNotFound, nil
} else if os.IsPermission(err) {
return http.StatusForbidden, err
}
// Return a different status code than above so as to distinguish these cases
return http.StatusInternalServerError, err
}
// redirect to canonical path
url := r.URL.Path
if d.IsDir() {
// Ensure / at end of directory url
if !strings.HasSuffix(url, "/") {
Redirect(w, r, path.Base(url)+"/", http.StatusMovedPermanently)
return http.StatusMovedPermanently, nil
}
} else {
// Ensure no / at end of file url
if strings.HasSuffix(url, "/") {
Redirect(w, r, "../"+path.Base(url), http.StatusMovedPermanently)
return http.StatusMovedPermanently, nil
}
}
// use contents of an index file, if present, for directory
if d.IsDir() {
for _, indexPage := range IndexPages {
index := strings.TrimSuffix(name, "/") + "/" + indexPage
ff, err := fs.Root.Open(index)
if err == nil {
// this defer does not leak fds because previous iterations
// of the loop must have had an err, so nothing to close
defer ff.Close()
dd, err := ff.Stat()
if err == nil {
d = dd
f = ff
break
}
}
}
}
// Still a directory? (we didn't find an index file)
// Return 404 to hide the fact that the folder exists
if d.IsDir() {
return http.StatusNotFound, nil
}
if fs.isHidden(d) {
return http.StatusNotFound, nil
}
// Experimental ETag header
e := fmt.Sprintf(`W/"%x-%x"`, d.ModTime().Unix(), d.Size())
w.Header().Set("ETag", e)
// Note: Errors generated by ServeContent are written immediately
// to the response. This usually only happens if seeking fails (rare).
http.ServeContent(w, r, d.Name(), d.ModTime(), f)
return http.StatusOK, nil
}
// isHidden checks if file with FileInfo d is on hide list.
func (fs FileServer) isHidden(d os.FileInfo) bool {
// If the file is supposed to be hidden, return a 404
for _, hiddenPath := range fs.Hide {
// Check if the served file is exactly the hidden file.
if hFile, err := fs.Root.Open(hiddenPath); err == nil {
fs, _ := hFile.Stat()
hFile.Close()
if os.SameFile(d, fs) {
return true
}
}
}
return false
}
// Redirect sends an HTTP redirect to the client but will preserve
// the query string for the new path. Based on http.localRedirect
// from the Go standard library.
func Redirect(w http.ResponseWriter, r *http.Request, newPath string, statusCode int) {
if q := r.URL.RawQuery; q != "" {
newPath += "?" + q
}
http.Redirect(w, r, newPath, statusCode)
}
// IndexPages is a list of pages that may be understood as
// the "index" files to directories.
var IndexPages = []string{
"index.html",
"index.htm",
"index.txt",
"default.html",
"default.htm",
"default.txt",
}