Merge branch 'master' into eaddrinuse

thgh · Aug 28, 2020 · 662e882 · 662e882
2 parents a1c9437 + 510c69c
commit 662e882
Show file tree

Hide file tree

Showing 7 changed files with 569 additions and 452 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to `rollup-plugin-serve` will be documented in this file.
 
+## [1.0.3] - 2020-07-21
+### Fixed
+- Fix path.normalize error on Windows
+
+## [1.0.2] - 2020-07-17
+### Fixed
+- Fix path traversal issue
+
 ## [1.0.1] - 2019-01-27
 ### Added
 - Add Intellisense support #34

diff --git a/README.md b/README.md
@@ -88,6 +88,11 @@ serve({
   headers: {
     'Access-Control-Allow-Origin': '*',
     foo: 'bar'
+  },
+
+  // set custom mime types, usage https://github.com/broofa/mime#mimedefinetypemap-force--false
+  mimeTypes: {
+    'application/javascript': ['js_commonjs-proxy']
   }
 })
 ```

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "rollup-plugin-serve",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "description": "Serve your rolled up bundle",
   "main": "dist/index.cjs.js",
   "module": "dist/index.es.js",
@@ -10,7 +10,7 @@
     "dev": "rollup -cw",
     "lint": "standard --fix rollup.config.js src/**",
     "prepare": "yarn lint && yarn build",
-    "test": "cd test && rollup -c || cd .."
+    "test": "cd test && rollup -cw || cd .."
   },
   "keywords": [
     "rollup",
@@ -33,12 +33,12 @@
     "dist"
   ],
   "dependencies": {
-    "mime": ">=2.0.3",
+    "mime": ">=2.4.6",
     "opener": "1"
   },
   "devDependencies": {
-    "rollup": "1",
-    "rollup-plugin-buble": "^0.15.0",
+    "@rollup/plugin-buble": "0.21.3",
+    "rollup": "2",
     "standard": "14"
   }
 }
diff --git a/rollup.config.js b/rollup.config.js
@@ -1,4 +1,4 @@
-import buble from 'rollup-plugin-buble'
+import buble from '@rollup/plugin-buble'
 
 export default {
   input: 'src/index.js',

diff --git a/src/index.js b/src/index.js
@@ -1,7 +1,7 @@
 import { readFile } from 'fs'
 import { createServer as createHttpsServer } from 'https'
 import { createServer } from 'http'
-import { resolve } from 'path'
+import { resolve, posix } from 'path'
 
 import mime from 'mime'
 import opener from 'opener'
@@ -23,9 +23,16 @@ function serve (options = { contentBase: '' }) {
   options.openPage = options.openPage || ''
   mime.default_type = 'text/plain'
 
+  if (options.mimeTypes) {
+    mime.define(options.mimeTypes, true)
+  }
+
   const requestListener = (request, response) => {
     // Remove querystring
-    const urlPath = decodeURI(request.url.split('?')[0])
+    const unsafePath = decodeURI(request.url.split('?')[0])
+
+    // Don't allow path traversal
+    const urlPath = posix.normalize(unsafePath)
 
     Object.keys(options.headers).forEach((key) => {
       response.setHeader(key, options.headers[key])
@@ -72,11 +79,10 @@ function serve (options = { contentBase: '' }) {
     server = createServer(requestListener).listen(options.port, options.host)
   }
 
-  // assemble url for error and info messages
-  const protocol = (options.https ? 'https' : 'http')
-  const hostname = options.host || 'localhost'
-  const url = protocol + '://' + hostname + ':' + options.port
+  // Assemble url for error and info messages
+  const url = (options.https ? 'https' : 'http') + '://' + (options.host || 'localhost') + ':' + options.port
 
+  // Handle common server errors
   server.on('error', e => {
     if (e.code === 'EADDRINUSE') {
       console.error(url + ' is in use, either stop the other server or use a different port.')
@@ -86,18 +92,20 @@ function serve (options = { contentBase: '' }) {
     }
   })
 
-  let running = options.verbose === false
+  let first = true
 
   return {
     name: 'serve',
     generateBundle () {
-      if (!running) {
-        running = true
+      if (first) {
+        first = false
 
         // Log which url to visit
-        options.contentBase.forEach(base => {
-          console.log(green(url) + ' -> ' + resolve(base))
-        })
+        if (options.verbose !== false) {
+          options.contentBase.forEach(base => {
+            console.log(green(url) + ' -> ' + resolve(base))
+          })
+        }
 
         // Open browser
         if (options.open) {
@@ -147,7 +155,7 @@ function green (text) {
   return '\u001b[1m\u001b[32m' + text + '\u001b[39m\u001b[22m'
 }
 
-function closeServerOnTermination() {
+function closeServerOnTermination () {
   const terminationSignals = ['SIGINT', 'SIGTERM', 'SIGQUIT', 'SIGHUP']
   terminationSignals.forEach(signal => {
     process.on(signal, () => {

diff --git a/test/rollup.config.js b/test/rollup.config.js
@@ -1,4 +1,4 @@
-import serve from '..'
+import serve from '../src/index.js'
 
 export default {
   input: 'entry.js',