From 5aba89119933676a854d97513ea3b435ff307a31 Mon Sep 17 00:00:00 2001 From: Tarang Patel Date: Sun, 10 Aug 2014 20:47:47 +0200 Subject: [PATCH 1/4] Update webapp_server.js --- packages/webapp/webapp_server.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/webapp/webapp_server.js b/packages/webapp/webapp_server.js index 422357e33b..2cc7817e5d 100644 --- a/packages/webapp/webapp_server.js +++ b/packages/webapp/webapp_server.js @@ -139,6 +139,10 @@ var appUrl = function (url) { if (url === '/app.manifest') return false; + //Serve ordinary html if this is a weird bot request + if (RoutePolicy.isProxyUrl(url)) + return true; + // Avoid serving app HTML for declared routes such as /sockjs/. if (RoutePolicy.classify(url)) return false; From f319109634f41892977e786ad184ec127868ffed Mon Sep 17 00:00:00 2001 From: Tarang Patel Date: Sun, 10 Aug 2014 20:53:15 +0200 Subject: [PATCH 2/4] Update webapp_server.js --- packages/webapp/webapp_server.js | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/packages/webapp/webapp_server.js b/packages/webapp/webapp_server.js index 2cc7817e5d..9c68268664 100644 --- a/packages/webapp/webapp_server.js +++ b/packages/webapp/webapp_server.js @@ -139,10 +139,6 @@ var appUrl = function (url) { if (url === '/app.manifest') return false; - //Serve ordinary html if this is a weird bot request - if (RoutePolicy.isProxyUrl(url)) - return true; - // Avoid serving app HTML for declared routes such as /sockjs/. if (RoutePolicy.classify(url)) return false; @@ -623,6 +619,13 @@ var runWebAppServer = function () { }); app.use(function (req, res, next) { + if (!RoutePolicy.isValidUrl(req.url)) { + res.writeHead(500, {'Content-Type': 'text/html'}); + res.write("Invalid Request"); + res.end(); + return undefined + } + if (! appUrl(req.url)) return next(); From 056e0acbd0ef79c782376f890e1b0ac4dd2646ee Mon Sep 17 00:00:00 2001 From: Tarang Patel Date: Sun, 10 Aug 2014 20:55:41 +0200 Subject: [PATCH 3/4] Update routepolicy.js --- packages/routepolicy/routepolicy.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/routepolicy/routepolicy.js b/packages/routepolicy/routepolicy.js index e426f6ac37..a8d332496f 100644 --- a/packages/routepolicy/routepolicy.js +++ b/packages/routepolicy/routepolicy.js @@ -96,6 +96,10 @@ _.extend(RoutePolicyConstructor.prototype, { // TODO overlapping prefixes, e.g. /foo/ and /foo/bar/ self.urlPrefixTypes[urlPrefix] = type; }, + + isValidUrl: function(url) { + return (url.charAt(0) === '/'); + }, classify: function (url) { var self = this; From 9023cccc28e3606bd539aa2b7a1863125a3d2b73 Mon Sep 17 00:00:00 2001 From: David Glasser Date: Fri, 9 Jan 2015 15:53:49 -0800 Subject: [PATCH 4/4] Clean up PR --- History.md | 1 + packages/routepolicy/routepolicy.js | 6 +++--- packages/webapp/webapp_server.js | 19 ++++++++++++------- 3 files changed, 16 insertions(+), 10 deletions(-) diff --git a/History.md b/History.md index e976580608..b74782128a 100644 --- a/History.md +++ b/History.md @@ -1,5 +1,6 @@ ## v.NEXT +* Fix stack trace when a browser tries to use the server like a proxy. #1212 ## v1.0.2.1, 2014-Dec-22 diff --git a/packages/routepolicy/routepolicy.js b/packages/routepolicy/routepolicy.js index a8d332496f..81e47c64c0 100644 --- a/packages/routepolicy/routepolicy.js +++ b/packages/routepolicy/routepolicy.js @@ -96,9 +96,9 @@ _.extend(RoutePolicyConstructor.prototype, { // TODO overlapping prefixes, e.g. /foo/ and /foo/bar/ self.urlPrefixTypes[urlPrefix] = type; }, - - isValidUrl: function(url) { - return (url.charAt(0) === '/'); + + isValidUrl: function (url) { + return url.charAt(0) === '/'; }, classify: function (url) { diff --git a/packages/webapp/webapp_server.js b/packages/webapp/webapp_server.js index 9c68268664..b5bd652d0e 100644 --- a/packages/webapp/webapp_server.js +++ b/packages/webapp/webapp_server.js @@ -565,6 +565,18 @@ var runWebAppServer = function () { var rawConnectHandlers = connect(); app.use(rawConnectHandlers); + // We're not a proxy; reject (without crashing) attempts to treat us like + // one. (See #1212.) + app.use(function(req, res, next) { + if (RoutePolicy.isValidUrl(req.url)) { + next(); + return; + } + res.writeHead(400); + res.write("Not a proxy"); + res.end(); + }); + // Strip off the path prefix, if it exists. app.use(function (request, response, next) { var pathPrefix = __meteor_runtime_config__.ROOT_URL_PATH_PREFIX; @@ -619,13 +631,6 @@ var runWebAppServer = function () { }); app.use(function (req, res, next) { - if (!RoutePolicy.isValidUrl(req.url)) { - res.writeHead(500, {'Content-Type': 'text/html'}); - res.write("Invalid Request"); - res.end(); - return undefined - } - if (! appUrl(req.url)) return next();