Node.js Express.js | 从视图/静态文件夹自动渲染车把模板

Question

I have got the following code to automatically load my handelbar templates from the views/static folder without having to manually setup a route for each page.

app.get("/:template", function(req,res){
    var template = req.params.template; // Is this safe?
    res.render("static/" + template, function(err, html) {
        if (err) {
            res.send(404, 'Sorry cant find that!');
        } else {
            res.send(html);
        }
    });
});

It works fine, however I am worried that this potentially exposes my app to security problems. Any suggestions how I could do this better. I am using Express. Thanks so much for your help.

Answer 1

I think it's pretty safe.

Usually, you have to worry about paths being passed that contain stuff like ../ (to go back a directory level), but those won't match your route. Also, the route you declare will stop matching at a / , so requests like /foo/../bar won't match either.

An issue that may occur is when the static directory contains files that you don't want to expose: a request for /secret.js will at least try to render a file called static/secret.js .