Redirect a directory to its trailing slash only when something is served there - #810
Merged
Merged
Conversation
…ved there The stdlib adds the trailing slash to a directory URL whenever its own directory_listing flag is on, and Kemal never sets that flag - it decides per request from serve_static. With dir_listing and dir_index both off, /admin answered 302 /admin/ while /nope answered 404: the redirect was the only difference, and it told a scanner which directories exist. Both Crystal-version branches now consult serve_static: a directory URL gets its canonical slash when a listing or an index.html would answer at it, and falls through to the missing-path 404 otherwise.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the Change
HTTP::StaticFileHandler#normalize_request_pathredirects/dir→/dir/whenever its@directory_listingflag is on. Kemal constructs the handler with the stdlib default (true) and never passes its owndir_listingsetting down — it readsserve_staticper request indirectory_indexinstead. Result, withdir_listinganddir_indexboth off (the default):Nothing is ever served at
/dir/in that configuration, so the redirect only tells the client that the directory is there. Directory enumeration underpublic/for free.The redirect now depends on
serve_static: a directory URL gets its trailing slash when a listing or anindex.htmlwould answer at the slashed URL, and falls through to the same404as a missing path otherwise. The ≥ 1.17 branch overridesnormalize_request_path; the legacy branch'sis_dircheck uses the same predicate.dir_indexkeeps the redirect on purpose — relative links in the index have to resolve against/dir/, not/.Alternate Designs
directory_listing:into the constructor fromConfig#setup_static_file_handler. Simpler, but the flag would be frozen at boot whiledirectory_indexreads the config at request time;serve_staticcan be called after the handler exists (the specs do). Reading it in one place per request keeps the two decisions consistent.Verification
Specs: neither on →
/diris404with noLocation(fails on master:302); listing on →302 /dir/; index on →302 /dir/. Full suite green (481), ameba and format clean.