Fix hyperparam source on dot files

Author: platypii

bin/serve.js

@@ -32,6 +32,12 @@ const mimeTypes = {
   '.woff2': 'font/woff2',
 }
 
+// Paths to ignore for logging
+const ignorePrefix = [
+  '/favicon.svg',
+  '/assets/',
+]
+
 /**
  * @template T
  * @typedef {T | Promise<T>} Awaitable<T>
@@ -286,6 +292,11 @@ function startServer(port, path) {
         pipe(content, res)
       }
 
+      // Ignored logging paths
+      if (ignorePrefix.some(p => req.url?.startsWith(p))) {
+        return
+      }
+
       // log request
       const endTime = new Date()
       const ms = endTime.getTime() - startTime.getTime()

src/lib/sources/hyperparamSource.ts

@@ -8,12 +8,6 @@ export interface HyperparamFileMetadata {
   lastModified: string
 }
 
-function canParse(sourceId: string): boolean {
-  /// we expect relative paths, such as path/to/file or path/to/dir/
-  /// let's just check that it is empty or starts with a "word" character
-  return sourceId === '' || /^[\w]/.test(sourceId)
-}
-
 function getSourceParts(sourceId: string): SourcePart[] {
   const parts = sourceId.split('/')
   const sourceParts = [
@@ -66,12 +60,10 @@ async function listFiles(prefix: string, { endpoint, requestInit }: {endpoint: s
 }
 
 export function getHyperparamSource(sourceId: string, { endpoint, requestInit }: {endpoint: string, requestInit?: RequestInit}): FileSource | DirSource | undefined {
-  if (!URL.canParse(endpoint)) {
-    throw new Error('Invalid endpoint')
-  }
-  if (!canParse(sourceId)) {
-    return undefined
-  }
+  if (!URL.canParse(endpoint)) throw new Error('Invalid endpoint')
+  if (sourceId.startsWith('/')) throw new Error('Source cannot start with a /')
+  if (sourceId.includes('..')) throw new Error('Source cannot include ..')
+
   const sourceParts = getSourceParts(sourceId)
   if (getKind(sourceId) === 'file') {
     return {

test/lib/sources/hyperparamSource.test.ts

@@ -6,27 +6,26 @@ globalThis.fetch = vi.fn()
 describe('getHyperparamSource', () => {
   const endpoint = 'http://localhost:3000'
 
-  test.for([
-    'test.txt',
-    'no-extension',
-    'folder/subfolder/test.txt',
-  ])('recognizes a local file path', (sourceId: string) => {
-    expect(getHyperparamSource(sourceId, { endpoint })?.kind).toBe('file')
+  it('recognizes local files', () => {
+    expect(getHyperparamSource('test.txt', { endpoint })?.kind).toBe('file')
+    expect(getHyperparamSource('no-extension', { endpoint })?.kind).toBe('file')
+    expect(getHyperparamSource('folder/subfolder/test.txt', { endpoint })?.kind).toBe('file')
   })
 
-  test.for([
-    '',
-    'folder1/',
-    'folder1/folder2/',
-  ])('recognizes a folder', (sourceId: string) => {
-    expect(getHyperparamSource(sourceId, { endpoint })?.kind).toBe('directory')
+  it('recognizes folders', () => {
+    expect(getHyperparamSource('', { endpoint })?.kind).toBe('directory')
+    expect(getHyperparamSource('folder1/', { endpoint })?.kind).toBe('directory')
+    expect(getHyperparamSource('folder1/folder2/', { endpoint })?.kind).toBe('directory')
   })
 
-  test.for([
-    '/',
-    '////',
-  ])('does not support a heading slash', (sourceId: string) => {
-    expect(getHyperparamSource(sourceId, { endpoint })).toBeUndefined()
+  it('throws on leading slash', () => {
+    expect(() => getHyperparamSource('/', { endpoint })).toThrow('Source cannot start with a /')
+    expect(() => getHyperparamSource('/folder/', { endpoint })).toThrow('Source cannot start with a /')
+  })
+
+  it('throws on .. in path', () => {
+    expect(() => getHyperparamSource('..', { endpoint })).toThrow('Source cannot include ..')
+    expect(() => getHyperparamSource('folder/../file.txt', { endpoint })).toThrow('Source cannot include ..')
   })
 
   test.for([