公用文件夹之外的文件是否安全？

Question

I'm building a website using Express.

I have a page with a form to add articles. There is no sensitive data on my website but I don't want people te be able to post articles.

So my question is: can people have access to any file that is not inside the public folder ?

// Public directory
web.use(express.static(path.join(__dirname, 'public')));

The page would be accessed with a token (the token would be encrypted and stored in a json file (outside the public folder)

like this :

// json file import
var data = require('../data/fileThatIsSafe.json');

// page render
web.get('/myPage/:token?', function(res, req) {
    if(encrypt(req.params.token) == data.token) {
        res.render('myPage');
    }
}

Answer 1

I can't tell exactly what the token has to do with your question, but if you're just asking if your express.static() code is safe:

web.use(express.static(path.join(__dirname, 'public')));

Then, the answer is that express.static() (by default) does not allow access to any files outside of the directory you pass it. in your example, it only provides access to the public directory hierarchy. If you look at the doc for express.static() , you will see an option for dotfiles that has these settings:

Possible values for this option are:

"allow"  - No special treatment for dotfiles.
"deny"   - Deny a request for a dotfile, respond with 403, then call next().
"ignore" - Act as if the dotfile does not exist, respond with 404, then call next().

The default value for this option is "ignore" and will return a 404.

So my question is: can people have access to any file that is not inside the public folder ?

Not via your express.static() middleware. So, the only way people could get access to other files on your server is if you have some other route that explicitly allows them to request those files.

In the one other route you show, that does appear to require an appropriate token be sent with the route before you will send the content. That specific route handler needs to send some sort of response (perhaps an error response) when the token does not match.