allow serving static files from the database

serve static files from the virtual filesystem

Author: lovasoa

Cargo.lock

@@ -16,7 +16,7 @@ actix-web = { version = "4", features = ["rustls"] }
 handlebars = "5.0.0-beta.0"
 log = "0.4.17"
 env_logger = "0.10.0"
-actix-files = "0.6.2"
+mime_guess = "2.0.4"
 futures-util = "0.3.21"
 dashmap = "5.4.0"
 tokio = { version = "1.24.1", features = ["rt"] }

Cargo.toml

@@ -4,7 +4,7 @@ use anyhow::Context;
 use chrono::{DateTime, Utc};
 use sqlx::any::{AnyKind, AnyStatement, AnyTypeInfo};
 use sqlx::postgres::types::PgTimeTz;
-use sqlx::{Executor, Postgres, Statement, Type};
+use sqlx::{Postgres, Statement, Type};
 use std::io::ErrorKind;
 use std::path::{Component, Path, PathBuf};
 
@@ -77,10 +77,12 @@ impl FileSystem {
     }
 
     fn safe_local_path(&self, path: &Path) -> anyhow::Result<PathBuf> {
-        anyhow::ensure!(
-            path.components().all(|c| matches!(c, Component::Normal(_))),
-            "Unsupported path: {path:?}"
-        );
+        for component in path.components() {
+            anyhow::ensure!(
+                matches!(component, Component::Normal(_)),
+                "Unsupported path: {path:?}. Path component {component:?} is not allowed."
+            );
+        }
         Ok(self.local_root.join(path))
     }
 }
@@ -165,6 +167,7 @@ impl DbFsQueries {
 
 #[actix_web::test]
 async fn test_sql_file_read_utf8() -> anyhow::Result<()> {
+    use sqlx::Executor;
     let state = AppState::init().await?;
     state
         .db

src/filesystem.rs

@@ -17,7 +17,6 @@ use std::net::{SocketAddr, ToSocketAddrs};
 use std::path::PathBuf;
 use templates::AllTemplates;
 
-const CONFIG_DIR: &str = "sqlpage";
 const TEMPLATES_DIR: &str = "sqlpage/templates";
 const MIGRATIONS_DIR: &str = "sqlpage/migrations";
 
@@ -26,7 +25,6 @@ const DEFAULT_DATABASE_FILE: &str = "sqlpage.db";
 pub struct AppState {
     db: Database,
     all_templates: AllTemplates,
-    web_root: PathBuf,
     sql_file_cache: FileCache<ParsedSqlFile>,
     file_system: FileSystem,
 }
@@ -44,7 +42,6 @@ impl AppState {
         Ok(AppState {
             db,
             all_templates,
-            web_root,
             sql_file_cache,
             file_system,
         })

src/main.rs

@@ -1,13 +1,13 @@
 use crate::render::{HeaderContext, PageContext, RenderContext};
 use crate::webserver::database::{stream_query_results, DbItem};
-use crate::{AppState, Config, ParsedSqlFile, CONFIG_DIR};
-use actix_web::dev::{ServiceFactory, ServiceRequest};
+use crate::{AppState, Config, ParsedSqlFile};
+use actix_web::dev::{fn_service, ServiceFactory, ServiceRequest};
 use actix_web::error::ErrorInternalServerError;
-use actix_web::http::header::{CacheControl, CacheDirective};
+use actix_web::http::header::{CacheControl, CacheDirective, ContentType};
 use actix_web::web::Form;
 use actix_web::{
-    dev::Service, dev::ServiceResponse, middleware, middleware::Logger, web, web::Bytes, App,
-    FromRequest, HttpResponse, HttpServer, Responder,
+    dev::ServiceResponse, middleware, middleware::Logger, web, web::Bytes, App, FromRequest,
+    HttpResponse, HttpServer, Responder,
 };
 
 use crate::utils::log_error;
@@ -19,7 +19,7 @@ use std::collections::HashMap;
 use std::io::Write;
 use std::mem;
 use std::net::IpAddr;
-use std::path::{Component, PathBuf};
+use std::path::PathBuf;
 use std::pin::Pin;
 use std::sync::Arc;
 use tokio::sync::mpsc;
@@ -348,6 +348,38 @@ async fn handle_static_js() -> impl Responder {
         .body(&include_bytes!("../../sqlpage/sqlpage.js")[..])
 }
 
+async fn serve_file(path: &str, state: &AppState) -> actix_web::Result<HttpResponse> {
+    let path = path.strip_prefix('/').unwrap_or(path);
+    state
+        .file_system
+        .read_file(state, path.as_ref())
+        .await
+        .map_err(actix_web::error::ErrorBadRequest)
+        .map(|b| {
+            HttpResponse::Ok()
+                .insert_header(
+                    mime_guess::from_path(path)
+                        .first()
+                        .map(ContentType)
+                        .unwrap_or(ContentType::octet_stream()),
+                )
+                .body(b)
+        })
+}
+
+async fn main_handler(mut service_request: ServiceRequest) -> actix_web::Result<ServiceResponse> {
+    let path = service_request.path();
+    let sql_file_path = path_to_sql_file(path);
+    if let Some(sql_path) = sql_file_path {
+        process_sql_request(service_request, sql_path).await
+    } else {
+        let app_state = service_request.extract::<web::Data<AppState>>().await?;
+        let path = service_request.path();
+        let response = serve_file(path, &app_state).await?;
+        Ok(service_request.into_response(response))
+    }
+}
+
 pub fn create_app(
     app_state: web::Data<AppState>,
 ) -> App<
@@ -360,32 +392,19 @@ pub fn create_app(
     >,
 > {
     App::new()
-            .route("sqlpage.js", web::get().to(handle_static_js))
-            .wrap_fn(|req, srv| {
-                let sql_file_path = path_to_sql_file(req.path());
-                let sql_file = if let Some(sql_path) = sql_file_path {
-                    Ok((req, sql_path))
-                } else {
-                    Err(srv.call(req))
-                };
-                async move {
-                    match sql_file {
-                        Ok((req, sql_path)) => process_sql_request(req, sql_path).await,
-                        Err(fallback) => fallback.await
-                    }
-                }
-            })
-            .default_service(
-                actix_files::Files::new("/", &app_state.web_root)
-                    .path_filter(|path, _|
-                        !matches!(path.components().next(), Some(Component::Normal(x)) if x == CONFIG_DIR))
-                    .show_files_listing()
-                    .use_last_modified(true),
-            )
-            .wrap(Logger::default())
-        .wrap(middleware::DefaultHeaders::new()
-            .add(("Server", format!("{} v{}", env!("CARGO_PKG_NAME"), env!("CARGO_PKG_VERSION"))))
-            .add(("Content-Security-Policy", "script-src 'self' https://cdn.jsdelivr.net"))
+        .route("sqlpage.js", web::get().to(handle_static_js))
+        .default_service(fn_service(main_handler))
+        .wrap(Logger::default())
+        .wrap(
+            middleware::DefaultHeaders::new()
+                .add((
+                    "Server",
+                    format!("{} v{}", env!("CARGO_PKG_NAME"), env!("CARGO_PKG_VERSION")),
+                ))
+                .add((
+                    "Content-Security-Policy",
+                    "script-src 'self' https://cdn.jsdelivr.net",
+                )),
         )
         .wrap(middleware::Compress::default())
         .app_data(app_state)