KjetilIN / rs-search-engine

A custom search engine built with Rust. It parses HTML files and utilizes TF-IDF scoring to rank document relevance based on search queries. The project includes a Rust-based backend server and vanilla HTML/CSS for the web frontend.
MIT License
0 stars 0 forks source link

Improve security for public file serving #2

Open KjetilIN opened 3 months ago

KjetilIN commented 3 months ago

What?

Within the ./public/ folder, there are files that can be served as they are. For now, the function is private, but to improve the code, one can implement functions for serving the files more secure.

Such as validating the input. The function is currently very simple, and is currently NOT A SECURITY ISSUE (due to hard-coded paths)

This is the code that needs improvement in the feature:


fn serve_public_file(file_name:&str, content_type: &str, request: Request) -> (){
    let file = format!("./src/public/{}", file_name);
    let content = read_file(&file);

    match content{
        Ok(ct) => {
            let response = Response::from_string(ct)
                                                                .with_header(tiny_http::Header::from_bytes(&b"Content-Type"[..], &content_type.as_bytes()[..]).unwrap());

            let _ = request.respond(response);
            return; 
        },
        Err(_) => {
            eprintln!("[ERROR] Could not read {}", file_name);
        },
    }
}

pub fn handle_get_request(request: Request)-> (){
    // Serve based on the url
    match request.url(){
        // INDEX File
        "/" => serve_public_file("index.html", "text/html", request),
        // Serving the styles request 
        "/style.css" => serve_public_file("style.css", "text/css", request),
        _ => {}
    }
}
``