自定义页面中只允许使用pages/目录下文件（兼容以往版本）

internal/nodes/http_request_page.go

@@ -6,9 +6,10 @@ import (
 	"github.com/TeaOSLab/EdgeNode/internal/remotelogs"
 	"github.com/TeaOSLab/EdgeNode/internal/utils"
 	"github.com/iwind/TeaGo/Tea"
-	"github.com/iwind/TeaGo/logs"
 	"net/http"
 	"os"
+	"path"
+	"strings"
 )
 
 // 请求特殊页面
@@ -54,30 +55,30 @@ func (this *HTTPRequest) doPageLookup(pages []*serverconfigs.HTTPPageConfig, sta
 					this.doURL(http.MethodGet, page.URL, "", newStatus, true)
 					return true
 				} else {
-					file := Tea.Root + Tea.DS + page.URL
-					fp, err := os.Open(file)
-					if err != nil {
-						logs.Error(err)
-						msg := "404 page not found: '" + page.URL + "'"
-
+					var realpath = path.Clean(page.URL)
+					if !strings.HasPrefix(realpath, "/pages/") && !strings.HasPrefix(realpath, "pages/") { // only files under "/pages/" can be used
+						var msg = "404 page not found: '" + page.URL + "'"
 						this.writer.WriteHeader(http.StatusNotFound)
-						_, err := this.writer.Write([]byte(msg))
-						if err != nil {
-							logs.Error(err)
-						}
+						_, _ = this.writer.Write([]byte(msg))
 						return true
 					}
+					var file = Tea.Root + Tea.DS + realpath
+					fp, err := os.Open(file)
+					if err != nil {
+						var msg = "404 page not found: '" + page.URL + "'"
+						this.writer.WriteHeader(http.StatusNotFound)
+						_, _ = this.writer.Write([]byte(msg))
+						return true
+					}
+					defer func() {
+						_ = fp.Close()
+					}()
 
 					stat, err := fp.Stat()
 					if err != nil {
-						logs.Error(err)
-						msg := "404 could not read page content: '" + page.URL + "'"
-
+						var msg = "404 could not read page content: '" + page.URL + "'"
 						this.writer.WriteHeader(http.StatusNotFound)
-						_, err := this.writer.Write([]byte(msg))
-						if err != nil {
-							logs.Error(err)
-						}
+						_, _ = this.writer.Write([]byte(msg))
 						return true
 					}
 
@@ -92,7 +93,7 @@ func (this *HTTPRequest) doPageLookup(pages []*serverconfigs.HTTPPageConfig, sta
 						this.writer.Prepare(nil, stat.Size(), status, true)
 						this.writer.WriteHeader(status)
 					}
-					buf := utils.BytePool1k.Get()
+					var buf = utils.BytePool1k.Get()
 					_, err = utils.CopyWithFilter(this.writer, fp, buf, func(p []byte) []byte {
 						return []byte(this.Format(string(p)))
 					})
@@ -104,10 +105,6 @@ func (this *HTTPRequest) doPageLookup(pages []*serverconfigs.HTTPPageConfig, sta
 					} else {
 						this.writer.SetOk()
 					}
-					err = fp.Close()
-					if err != nil {
-						logs.Error(err)
-					}
 				}
 
 				return true

internal/nodes/http_request_shutdown.go

@@ -5,14 +5,15 @@ import (
 	"github.com/TeaOSLab/EdgeNode/internal/remotelogs"
 	"github.com/TeaOSLab/EdgeNode/internal/utils"
 	"github.com/iwind/TeaGo/Tea"
-	"github.com/iwind/TeaGo/logs"
 	"net/http"
 	"os"
+	"path"
+	"strings"
 )
 
 // 调用临时关闭页面
 func (this *HTTPRequest) doShutdown() {
-	shutdown := this.web.Shutdown
+	var shutdown = this.web.Shutdown
 	if shutdown == nil {
 		return
 	}
@@ -34,28 +35,30 @@ func (this *HTTPRequest) doShutdown() {
 				this.ProcessResponseHeaders(this.writer.Header(), http.StatusOK)
 				this.writer.WriteHeader(http.StatusOK)
 			}
-			_, err := this.writer.WriteString("The site have been shutdown.")
-			if err != nil {
-				logs.Error(err)
-			}
-
+			_, _ = this.writer.WriteString("The site have been shutdown.")
 			return
 		}
 
 		// 从本地文件中读取
-		file := Tea.Root + Tea.DS + shutdown.URL
-		fp, err := os.Open(file)
-		if err != nil {
-			logs.Error(err)
-			msg := "404 page not found: '" + shutdown.URL + "'"
-
+		var realpath = path.Clean(shutdown.URL)
+		if !strings.HasPrefix(realpath, "/pages/") && !strings.HasPrefix(realpath, "pages/") { // only files under "/pages/" can be used
+			var msg = "404 page not found: '" + shutdown.URL + "'"
 			this.writer.WriteHeader(http.StatusNotFound)
-			_, err = this.writer.Write([]byte(msg))
-			if err != nil {
-				logs.Error(err)
-			}
+			_, _ = this.writer.Write([]byte(msg))
 			return
 		}
+		var file = Tea.Root + Tea.DS + shutdown.URL
+		fp, err := os.Open(file)
+		if err != nil {
+			var msg = "404 page not found: '" + shutdown.URL + "'"
+			this.writer.WriteHeader(http.StatusNotFound)
+			_, _ = this.writer.Write([]byte(msg))
+			return
+		}
+
+		defer func() {
+			_ = fp.Close()
+		}()
 
 		// 自定义响应Headers
 		if shutdown.Status > 0 {
@@ -65,7 +68,7 @@ func (this *HTTPRequest) doShutdown() {
 			this.ProcessResponseHeaders(this.writer.Header(), http.StatusOK)
 			this.writer.WriteHeader(http.StatusOK)
 		}
-		buf := utils.BytePool1k.Get()
+		var buf = utils.BytePool1k.Get()
 		_, err = utils.CopyWithFilter(this.writer, fp, buf, func(p []byte) []byte {
 			return []byte(this.Format(string(p)))
 		})
@@ -77,11 +80,6 @@ func (this *HTTPRequest) doShutdown() {
 		} else {
 			this.writer.SetOk()
 		}
-
-		err = fp.Close()
-		if err != nil {
-			remotelogs.Warn("HTTP_REQUEST_SHUTDOWN", "close file failed: "+err.Error())
-		}
 	} else if shutdown.BodyType == shared.BodyTypeHTML {
 		// 自定义响应Headers
 		if shutdown.Status > 0 {

internal/nodes/http_request_url.go

@@ -67,8 +67,8 @@ func (this *HTTPRequest) doURL(method string, url string, host string, statusCod
 	}
 
 	// 输出内容
-	pool := this.bytePool(resp.ContentLength)
-	buf := pool.Get()
+	var pool = this.bytePool(resp.ContentLength)
+	var buf = pool.Get()
 	if supportVariables {
 		_, err = utils.CopyWithFilter(this.writer, resp.Body, buf, func(p []byte) []byte {
 			return []byte(this.Format(string(p)))