Escape static folder in Express - node.js

I set my /public folder as the static directory with express...
app.use(express.static('public'));
I need to include a script tag in my html linking to a file that is located outside of the public directory. (The script itself is a JS file that I installed with npm and is located in node-modules folder).
How do I escape the public directory in my html? I've tried all kinds of variations of ../ but it won't let me out of public.
Maybe there is a better way to handle this rather than trying to link to a script that is located in my node-modules folder?
Any help is appreciated

You don't escape the public directory with express.static(). That is done for security reasons so people can't make up URLs and go poking around your server hard drive.
Instead, you need to make a new route for that script file. If it's a single file and it's in a node_modules directory below where your source file is, you can make just a simple single route:
app.get("/myscript.js", function(req, res) {
res.sendFile(path.join(__dirname, "node_modules/someModule/somescript.js"));
});
Note in this example that the URL you use does not have to be the same as the file's actual name. Unlike with express.static(), they are independent when making a custom route like this so you can make the URL filename be whatever you want as long as it doesn't conflict with other routes you have.
If there are multiple files in that same directory that you want public, but you don't want others in that directory hierarchy to be public, then you can't really use another express.static() to only target a couple files in that directory so you'd either have to move the public files to their own directory or make an individual route for each file.
Here are some other examples:
How to include scripts located inside the node_modules folder?
How to add static file from `node_modules` after declare the `public` as static in express?

You could download just the script and then store it in your public folder.

Related

Is it possible to give a custom path to the `/static` directory using React and Express?

Edit
To anyone coming here in the future, I solved this problem by indicating a value for PUBLIC_URL in my .env file.
In my case, I set PUBLIC_URL=/ui and now the static assets are being served from .../ui/static/...
Whenever I build my app and launch it, the browser requests content from the static directory, such as this:
Is it possible to somehow change this? I took a look here, but I didn't have any luck. I tried different combinations of express.static(. . .) to no avail.
Instead of http:///static/bundle123, I want it to request http:///custom/static/bundle123.
I've tried moving my build/static directory into build/custom/static and doing something like this, but it didn't work:
app.use('/static', express.static(path.join(__dirname, './custom')))
What am I doing wrong?
The first argument determines the URL path and the second part determines where the files are located on the file system.
So if your static files are located in the public directory (or in sub directories) and you want to access then on the https://.../static URL, you can use:
app.use('/static', express.static(path.join(__dirname, 'public')));
In your case, assuming you run the server from the build directory, using the following should work:
app.use('/custom/static', express.static(path.join(__dirname, 'static')));
Now if you request an URL https:///custom/static/foo Express will look for a file named foo in the static folder.

Nodejs file direct access in browser

At Plesk server there are nodejs and reactjs build on hit url the build run but when we hit the nodejs file url of js files it open directly on browser means nodejs files are not secure.
So, it sounds like you are using express.static(), yet the user is able to fetch your server files that are not meant to go to the client. That apparently means that you've pointed express.static at a directory that contains your server files. Instead, you need to point express.static() at a directory hierarchy that ONLY contains files meant to be sent to the client. That means it has to be a separate directory from your server files and it has to not be above your server files directory.
There are many possible places to put it. Here are a couple ways to organize things:
projectDirectory
serverFiles
server.js
clientFiles
index.html
login.html
Then, when running server code from the serverFiles directory, you would use an express.static() like this:
const path = require('path');
app.use(express.static(path.join(__dirname, "../clientFiles")));
Or, you can do it like this:
projectDirectory
serverFiles
server.js
clientFiles
index.html
login.html
const path = require('path');
app.use(express.static(path.join(__dirname, "clientFiles")));
The idea is that the clientFiles directory hierarchy contains only client-side files and express.static() by default will not allow ../ syntax in the URLs to go above it.

How do I serve static files for my node-js server which are in my application root directory

Using app.use(express.static('public')) serves the files located under public folder
But if my files are outside the public folder in my application root directly how to serve them.
If you want to serve files in a folder outside of the current working directory, './../<dir_name>' is the way to go.
If you want to serve individual files instead of a directory, then you can use either,
app.use("/<some_url>", express.static(__dirname + '<path_to_file>'));
or
res.sendFile('<path_to_file>');
or use a simple library like, https://www.npmjs.com/package/connect-static-file.
I recommend the first approach though.
Note: replace the <text> with your file names and path names as required.
You can use ./../ to go the parent of the current folder. If you have the following structure:
project
- public
- app_folder
-- app.js
You can use './../public' as the static folder.

grunt-usemin block paths not relative to html file?

Having a lot of trouble understand how paths are treated at various points in the configuration and usage of grunt-usemin.
I've got the following repo layout, where the repo root will also be the web app root:
/dashboard/index.html
/Gruntfile.js
/vendor/...some 3rd party CSS and JS...
So the index.html file -> somedomain.com/dashboard/index.html.
The index.html file includes some CSS and JS assets from the /vendor folder. I have grunt configured to put build output in a build folder:
/build/dashboard/index.html
In the index.html file, I have usemin blocks wrapped around all the CSS link and JS script tags:
<!-- build:css(.) app.min.css -->
<!-- build:js(.) app.min.js -->
I had to specify an "alternative search path" with "(.)" so that a script tag for "/vendor/backbone.js" will find it in the right place. Until I did that, it was looking for /dashboard/vendor/backbone.js.
I want the output of processing the CSS/JS assets to be output to build/dashboard/app.min.css and build/dashboard/app.min.js, and included by index.html using a simple relative "app.min.css/js" path.
The problem is, grunt-usemin seems to be using the "app.min.*" path I'm specifying for both contexts in a way that makes it impossible for them to work together:
1) It treats the path as relative to the build directory for purposes of creating the file; the files end up in build/app.min.css and build/app.min.js.
2) It treats the path as relative to the index.html file for purposes of generating the new link/script tags; the browser loads build/dashboard/index.html, which then tries to load "app.min.css", which maps to build/dashboard/app.min.css.
Is there a solution?
I'm really late to the party, but I was also extremely frustrated by this issue and didn't find any satisfying fixes or work arounds. So I worked out some pretty dirty tricks to hopefully better work around this issue. So I'd like to share it with you.
First of all, let's quickly review why this issue happens. When usemin generates output JS/CSS files, it performs a simple path join between your dest directory and the output directory you specified in your usemin block. So if dest is build and usemin block is
<!-- build:css(.) app.min.css -->
then it joins build with app.min.css to spit out the output file at build/app.min.css
But then the usemin task simply replaces the path in your block to you end up with
<link rel="stylesheet" href="app.min.css"/>
which is now linking the wrong directory since your HTML file is under build/dashboard/index.html
So my work around revolves around this idea: what if dest directory is relative to where the HTML file is located? Wouldn't that solve this issue? So given the above example, what if dest is build/dashboard? You can see that it will spit out the output file location and link it correctly. Keep in mind that you are supposed to create a copy task to copy over your HTML files, so make sure your HTML file is copied to build/dashboard/index.html as before.
Of course, the next question would be what if I have HTML files in multiple directories? Wouldn't that be super painful and unintuitive to create a useminPrepare target for each directory, where HTML files could reside? This is why I create a very special grunt task just for working around this issue while I was creating my own grunt scaffolding. I call it useminPreparePrepare Yes, it's deliberately named stupidly, because I'm hoping to remove this thing altogether one day when usemin people make an actual fix for this issue.
As its name suggests, this is a task to prepare useminPrepare configs. It does exactly what I described above. All of its configs mirror useminPrepare configs (in fact, most of them are simply copied over to useminPrepare), with one exception: you need to specify a src directory to identify the root directory of all of your sources so that it can generate relative path to the HTML files. So in your example src: "." will be fine. To use useminPreparePrepare, import it into your build first (you may want to just copy and paste my code, I don't mind), rename your useminPrepare task to useminPreparePrepare and add src property that I just mentioned. Make sure you run useminPreparePrepare with whatever target you like, then immediately run useminPrepare without specifying target so that all of its targets are run. This is because useminPreparePrepare will generate one target for each directory relative to where HTML files are found and copies over your configs for the useminPreparePrepare target your ran. This way, your config can simply look for all HTML files.
Example
"useminPreparePrepare": {
// Search for HTML files under dashboard even though src is .
// because we want to avoid including files generated under build directory.
html: "dashboard/**/*.html",
options: {
src: ".",
dest: "build",
...
"usemin": {
html: ["build/**/*.html"],
...
"copy": {
html: {
files: [{
expand: true,
src: ["dashboard/**/*.html"],
dest: "build"
}
]
},
...
Hope this helps! Have a good day.
EDIT: I realized that given the above example, if you actually include all HTML files from current directory, you will include the generated HTML files too if they are not cleaned ahead of time. So either you clean them ahead of them or look under dashboard directory. I'd recommend separating src and dest directories so that config could look a lot more intuitively.
I don't like it, but the only way I've found to make it work so far is to specify a full path:
<!-- build:css(.) /dashboard/app.min.css -->
<!-- build:js(.) /dashboard/app.min.js -->
The leads to the app* files being in /build/dashboard alongside index.html (which is where I want them), and index.html ends up with the following tags:
<link rel="stylesheet" href="/dashboard/app.min.css">
<script src="/dashboard/app.min.js"></script>
It means the dashboard app is now acutely aware of it's location within the whole, so you can't just rename or relocate it's position in the tree without updating those paths.

Reading files from a directory inside a meteor app

How can i read the public directory in a meteor application inside my /server path.
I tried using the native 'fs' package but i keep getting a file/directory not found error.
var fs = Npm.require('fs');
var files = fs.readdirSync('/public/soundfiles/');
Has anyone used the filesystem package to read static files inside a meteor application?
I learned that it is best to upload files in your private folder if you are not displaying them outside.
In my case I need to store XML uploads and process them.
At first I wrote the XML into the public folder but that would trigger a reload.
Then I renamed the the upload folder to /public/.#uploads which would stop the reload of Meteor, but then again...it completely ignored that folder during build and the uploaded folder would not exist in the build (throw ENOENT error during read).
So I figured out it is best to put the files in /private/files and then reading goes as follows:
result = fs.readdirSync('assets/app/files')
Everything in the private folder will be moved to the Assets folder where during runtime there is an APP folder available (you do not see that in your build folder structure).
It helps to just simple dump result = fs.readdirSync('.') to see what folder you in and look through the structure.
***UPDATE*****
Locally putting files in private folder still triggered meteor rebuild/update (perhaps not in production..) so I found another solution using the UploadServer just to define the upload directory:
https://github.com/tomitrescak/meteor-uploads
This works for me in Meteor 1.0:
var fs = Npm.require('fs')
var xsd = fs.readFileSync(process.cwd().split('.meteor')[0] + 'server/company.xsd', 'utf8')
Access files without the "/public" part. In a running Meteor app, the public directory becomes your root, and everything that is located at /public/whatever can be accessed at /whatever.
Additionally, if you're playing around with files, you might find these useful:
FileSaver.js
CollectionFS
This is no longer true. For Meteor 0.8, the folder "../client/app" is public. Thus, use fs.readdirSync('../client/app') to get files and folders in public.
Source: personal experience and https://stackoverflow.com/a/18405793
For meteor 1.0.2 public is /web.browser/app/
Checked by entering .meteor dir
Total path in linux /home/user/your_app_name/.meteor/local/build/programs/web.browser/app/
And to get to root is `process.env.PWD or process.cwd().
Im not sure if its work deployed.
_meteor_bootstrap_.serverDir +'/assets/app'
This is path to private folder.
For Meteor 1.4, use server Assets.
See the official docs on Assets
http://docs.meteor.com/api/assets.html
On the server you can use fs to access any part of the meteor directory tree, not just /public, for example
import fs from 'fs';
const rd = process.env.PWD;
const obj = JSON.parse(fs.readFileSync(`${rd}/private/file.json`));
would read and parse a json file located at private/file.json under your meteor app directory root.

Resources