From bb5ba2456993fe5c733921655b88e8b4704489a4 Mon Sep 17 00:00:00 2001
From: Ruben Verborgh <ruben@verborgh.org>
Date: Sun, 2 Jun 2019 20:34:11 +0200
Subject: [PATCH] Avoid globbing hack.

Also reduces globbing in scope to all files in one folder,
as in https://github.com/solid/solid-spec/pull/148
---
 lib/handlers/get.js           | 21 ++++++++++++++-------
 test/integration/http-test.js |  2 +-
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/lib/handlers/get.js b/lib/handlers/get.js
index 139e22e8f..74c85bda0 100644
--- a/lib/handlers/get.js
+++ b/lib/handlers/get.js
@@ -132,10 +132,18 @@ async function handler (req, res, next) {
 }
 
 async function globHandler (req, res, next) {
-  const ldp = req.app.locals.ldp
-  // TODO: This is a hack, that does not check if the target file exists, as this is quite complex with globbing.
-  // TODO: Proper support for this is not implemented, as globbing support might be removed in the future.
-  const filename = ldp.resourceMapper.getFilePath(req)
+  const { ldp } = req.app.locals
+
+  // Ensure this is a glob for all files in a single folder
+  // https://github.com/solid/solid-spec/pull/148
+  const requestUrl = await ldp.resourceMapper.getRequestUrl(req)
+  if (!/^[^*]+\/\*$/.test(requestUrl)) {
+    return next(error(404, 'Unsupported glob pattern'))
+  }
+
+  // Extract the folder on the file system from the URL glob
+  const folderUrl = requestUrl.substr(0, requestUrl.length - 1)
+  const folderPath = (await ldp.resourceMapper.mapUrlToFile({ url: folderUrl })).path
 
   const globOptions = {
     noext: true,
@@ -143,7 +151,7 @@ async function globHandler (req, res, next) {
     nodir: true
   }
 
-  glob(filename, globOptions, async (err, matches) => {
+  glob(`${folderPath}*`, globOptions, async (err, matches) => {
     if (err || matches.length === 0) {
       debugGlob('No files matching the pattern')
       return next(error(404, 'No files matching glob pattern'))
@@ -178,8 +186,7 @@ async function globHandler (req, res, next) {
       })
     })))
 
-    const requestUri = ldp.resourceMapper.getRequestUrl(req)
-    const data = $rdf.serialize(undefined, globGraph, requestUri, 'text/turtle')
+    const data = $rdf.serialize(undefined, globGraph, requestUrl, 'text/turtle')
     // TODO this should be added as a middleware in the routes
     res.setHeader('Content-Type', 'text/turtle')
     debugGlob('returning turtle')
diff --git a/test/integration/http-test.js b/test/integration/http-test.js
index b4d6de866..68b0801c9 100644
--- a/test/integration/http-test.js
+++ b/test/integration/http-test.js
@@ -323,7 +323,7 @@ describe('HTTP APIs', function () {
         .expect(200, done)
     })
     it('should have glob support', function (done) {
-      server.get('/sampleContainer/example*')
+      server.get('/sampleContainer/*')
         .expect('content-type', /text\/turtle/)
         .expect(200)
         .expect((res) => {