Redirect to external website #26
Description
Stumbled upon a weird behavior where serve-static would redirect to an external website when "asked nicely".
Reproduction Steps
Using express 4.10.6 and static-serve 1.7.1 on node 0.10.33.
1. Simple app.js
var app = require('express')();
app.use(require('serve-static')('assets'));
app.listen(80);2. Start server
$ sudo node app.js3. Open in Firefox http://localhost//www.google.com/%2e%2e
Request
GET //www.google.com/%2e%2e HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-aliveResponse
HTTP/1.1 303 See Other
X-Powered-By: Express
Content-Type: text/html; charset=utf-8
Location: //www.google.com/%2e%2e/
Date: Sat, 03 Jan 2015 01:13:49 GMT
Connection: keep-alive
Transfer-Encoding: chunked
Redirecting to <a href="//www.google.com/%2e%2e/">//www.google.com/%2e%2e/</a>4. You get redirected to Google...
It works in Firefox, Safari and probably IE, not in Chrome.
Setting static-serve’s option redirect: false seems to fix it (but redirect: true is the default).
It looks like many applications could be affected.
A quick test on apps listed on http://expressjs.com/resources/applications.html does not disappoint:
- https://myspace.com//www.google.com/%2e%2e
- https://www.learnboost.com//www.google.com/%2e%2e
- https://geekli.st//www.google.com/%2e%2e
- etc
send emits directory in that case, which triggers the redirection.