refactor(sio): align client file matching in Node.js HTTP server

Use the same explicit allowlist of shipped Socket.IO client bundles
when serving static files from the Node.js HTTP server.

Author: darrachequesne

packages/socket.io/lib/index.ts

@@ -52,7 +52,6 @@ import corsMiddleware from "cors";
 const debug = debugModule("socket.io:server");
 
 const clientVersion = require("../package.json").version;
-const dotMapRegex = /\.map/;
 
 const CLIENT_FILES = new Set([
   "socket.io.esm.min.js",
@@ -285,7 +284,6 @@ export class Server<
   private readonly opts: Partial<ServerOptions>;
   private eio: Engine;
   private _path: string;
-  private clientPathRegex: RegExp;
 
   /**
    * @private
@@ -428,12 +426,6 @@ export class Server<
 
     this._path = v!.replace(/\/$/, "");
 
-    const escapedPath = this._path.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
-    this.clientPathRegex = new RegExp(
-      "^" +
-        escapedPath +
-        "/socket\\.io(\\.msgpack|\\.esm)?(\\.min)?\\.js(\\.map)?(?:\\?|$)",
-    );
     return this;
   }
 
@@ -631,32 +623,39 @@ export class Server<
     const evs = srv.listeners("request").slice(0);
     srv.removeAllListeners("request");
     srv.on("request", (req, res) => {
-      if (this.clientPathRegex.test(req.url!)) {
-        if (this._corsMiddleware) {
-          this._corsMiddleware(req, res, () => {
-            this.serve(req, res);
-          });
-        } else {
-          this.serve(req, res);
-        }
-      } else {
-        for (let i = 0; i < evs.length; i++) {
-          evs[i].call(srv, req, res);
+      if (req.url.startsWith(this._path)) {
+        const filename = this.extractFilename(req.url);
+        if (CLIENT_FILES.has(filename)) {
+          if (this._corsMiddleware) {
+            this._corsMiddleware(req, res, () => {
+              this.serve(filename, req, res);
+            });
+          } else {
+            this.serve(filename, req, res);
+          }
+          return;
         }
       }
+      for (let i = 0; i < evs.length; i++) {
+        evs[i].call(srv, req, res);
+      }
     });
   }
 
   /**
    * Handles a request serving of client source and map
    *
+   * @param filename
    * @param req
    * @param res
    * @private
    */
-  private serve(req: IncomingMessage, res: ServerResponse): void {
-    const filename = req.url!.replace(this._path, "").replace(/\?.*$/, "");
-    const isMap = dotMapRegex.test(filename);
+  private serve(
+    filename: string,
+    req: IncomingMessage,
+    res: ServerResponse,
+  ): void {
+    const isMap = filename.endsWith(".map");
     const type = isMap ? "map" : "source";
 
     // Per the standard, ETags must be quoted:

packages/socket.io/test/server-attachment.ts

@@ -190,6 +190,47 @@ describe("server attachment", () => {
     });
   });
 
+  describe("static files", () => {
+    let io: Server;
+    let port: number;
+
+    beforeEach(() => {
+      io = new Server(0);
+      port = getPort(io);
+    });
+
+    afterEach(() => {
+      io.close();
+    });
+
+    it("should serve socket.io.js", async () => {
+      const res = await fetch(
+        `http://localhost:${port}/socket.io/socket.io.js`,
+      );
+
+      expect(res.status).to.be(200);
+      expect(res.headers.get("content-type")).to.be(
+        "application/javascript; charset=utf-8",
+      );
+    });
+
+    it("should not serve unknown files from the Socket.IO path", async () => {
+      const res = await fetch(
+        `http://localhost:${port}/socket.io/socket.io.esm.js`,
+      );
+
+      expect(res.status).to.be(400);
+    });
+
+    it("should return 404 for mismatching path", async () => {
+      const res = await fetch(
+        `http://localhost:${port}/abcdefghij/socket.io.js`,
+      );
+
+      expect(res.status).to.be(404);
+    });
+  });
+
   describe("port", () => {
     it("should be bound", (done) => {
       const io = new Server(0);