Remove node-static dependency from testkit-backend (#1125)

This library has security vulnerabilities and it's not actively maintained.

Their usage was replaced by a very basic implementation of static file server.

See: https://github.com/neo4j/neo4j-javascript-driver/security/dependabot/134

Author: bigmontz

packages/testkit-backend/package-lock.json

@@ -34,7 +34,6 @@
   "dependencies": {
     "neo4j-driver": "5.0.0-dev",
     "neo4j-driver-lite": "5.0.0-dev",
-    "node-static": "^0.7.11",
     "ws": "^8.11.0"
   },
   "devDependencies": {

packages/testkit-backend/package.json

@@ -1,7 +1,7 @@
 import Controller from './interface'
 import { WebSocketServer } from 'ws'
 import { createServer } from 'http'
-import { Server } from 'node-static'
+import { HttpStaticServer } from '../infrastructure'
 
 /**
  * RemoteController handles the requests by sending them a remote client.
@@ -14,7 +14,9 @@ import { Server } from 'node-static'
 export default class RemoteController extends Controller {
   constructor (port) {
     super()
-    this._staticServer = new Server('./public')
+    this._staticServer = new HttpStaticServer({
+      basePath: './public'
+    })
     this._port = port
     this._wss = null
     this._ws = null

packages/testkit-backend/src/controller/remote.js

@@ -0,0 +1,67 @@
+import fs from 'fs'
+
+const DEFAULT_MIME_TYPES = {
+  html: 'text/html',
+  js: 'text/javascript'
+}
+
+const DEFAULT_MIME_TYPE = 'text/plain'
+
+const DEFAULT_INDEX_FILE = '/index.html'
+
+/**
+ * This a very minimal implementation of a static files http server.
+ *
+ * This is intend to be used only in the ${@link RemoteController} scenario and
+ * this is not feature complete.
+ *
+ * Some security measures to avoid external elements to sniff to files out of the base
+ * path are in place. Like Directory Transversal.
+ */
+export class HttpStaticServer {
+  constructor ({
+    basePath,
+    mimeTypes,
+    defaultMimeType,
+    indexFile
+  } = {}) {
+    this._basePath = basePath
+    this._mimeTypes = mimeTypes || DEFAULT_MIME_TYPES
+    this._indexFile = indexFile || DEFAULT_INDEX_FILE
+    this._defaultMimeType = defaultMimeType || DEFAULT_MIME_TYPE
+  }
+
+  serve (request, response) {
+    if (request.method === 'GET') {
+      const file = request.url !== '/' ? request.url : this._indexFile
+      const filePath = `${this._basePath}${file}`
+      const [, extension, ...rest] = file.split('.')
+      if (rest.length > 0) {
+        writeError(response, 403, '403 Forbidden!')
+        return
+      }
+
+      if (!fs.existsSync(filePath)) {
+        writeError(response, 404, '404 Not Found!')
+        return
+      }
+
+      fs.readFile(filePath, 'utf-8', (err, message) => {
+        if (err) {
+          console.error(`HttpStaticServer: Error reading file ${filePath}`, err)
+          writeError(response, 500, '500 Internal Server Error!')
+          return
+        }
+        response.writeHead(200, { 'Content-Type': this._mimeTypes[extension] || this._defaultMimeType })
+        response.write(message)
+        response.end()
+      })
+    }
+  }
+}
+
+function writeError (response, code, errorMessage) {
+  response.writeHead(code, { 'Content-Type': 'text/plain' })
+  response.write(errorMessage)
+  response.end()
+}

packages/testkit-backend/src/infrastructure/http-static.server.js

@@ -0,0 +1 @@
+export { HttpStaticServer } from './http-static.server'