Express 不会在虚拟主机中提供静态 ejs 文件

Question

我能得到的最接近的是它会让客户端下载它们。它将下载正确的 ejs 文件。

这让我发疯，因为我觉得它应该有效，但它不会。如果我把 html 文件放在那里，它们就可以了。有点乱，因为我一直在尝试各种事情。

var application_root = __dirname;
var express = require('express');
var vhost = require( 'vhost' );
var https = require('https');
var http = require('http');
var fs = require('fs');
var path = require("path");
var forceSSL = require('express-force-ssl');
//do something
var app = express();
var credentials = {};

var config = require('./config.json')[process.env.NODE_ENV || 'dev'];

//Use ejs?
app.set('view engine', 'ejs');
app.engine('html', require('ejs').renderFile);

//Ensure all are going to www.
app.all(/.*/, function(req, res, next) {
  var host = req.header("host");
  if (host.match(/^www\..*/i)) {
    next();
  } else {
    res.redirect(301, "http://www." + host);
  }
});

//Use the virtual hosts
app.use(vhost('*.seq.agency',express.static(path.join(__dirname + '/seq.agency'), {
  extensions: ['ejs'],
  index: 'index.ejs'
})));

app.get('/', function (req, res) {
  res.send('vhosts didn\'t catch this!')
});

var httpServer = http.createServer(app);
if(config.name == "prod"){
    /*var options = {
         key: fs.readFileSync('/etc/letsencrypt/live/kaleidoscope.wtf/privkey.pem'),
         cert: fs.readFileSync('/etc/letsencrypt/live/kaleidoscope.wtf/fullchain.pem'),
         ca: fs.readFileSync('/etc/letsencrypt/live/kaleidoscope.wtf/chain.pem')
    }*/
    console.log('starting on 443');
    //var httpsServer = https.createServer(options, app);
    //httpsServer.listen(443);
    //httpServer.listen(80);
    //app.use(forceSSL);
}

console.log('['+config.name+'] starting on port',config.port);
httpServer.listen(config.port);

Answer 1

问题是您正在考虑渲染静态文件。顾名思义，静态文件是静态的，不需要动态行为和模板渲染

这就是为什么下面的代码不能工作

app.use(vhost('*.seq.agency',express.static(path.join(__dirname + '/seq.agency'), {
  extensions: ['ejs'],
  index: 'index.ejs'
})));

正如您要求它按原样提供文件而不进行处理。因此，我稍微修改了您的代码，以向您展示如何解决此问题的示例

var application_root = __dirname;
var express = require('express');
var vhost = require( 'vhost' );
var https = require('https');
var http = require('http');
var fs = require('fs');
var path = require("path");
var forceSSL = require('express-force-ssl');
//do something
var app = express();
var credentials = {};

var config = require('./config.json')[process.env.NODE_ENV || 'dev'];

//Use ejs?
ejs = require("ejs");
app.set('view engine', 'html');
app.engine('html', ejs.renderFile);
app.engine('ejs', ejs.renderFile);

//Ensure all are going to www.
app.all(/.*/, function(req, res, next) {
    var host = req.header("host");
    if (host.match(/^www\..*/i)) {
        next();
    } else {
        res.redirect(301, "http://www." + host);
    }
});

//Use the virtual hosts
app.use(vhost('*.seq.agency',function (req, res, next)
{
    const reqPath = req.path;
    const paths =
        [
            reqPath + ".html",
            reqPath + "index.html",
            reqPath
        ]

    for (file of paths) {
        try {
            let checkPath = path.join(__dirname,"seq.agency", file);
            if (!fs.existsSync(checkPath))
                continue;

            let stat = fs.statSync(checkPath);
            if (stat && stat.isFile())
            {
                res.render(checkPath);
                return;
            }
        } finally {

        }
    }

    console.log(file);
}));

app.get('/', function (req, res) {
    res.send('vhosts didn\'t catch this!')
});

var httpServer = http.createServer(app);
if(config.name == "prod"){
    /*var options = {
         key: fs.readFileSync('/etc/letsencrypt/live/kaleidoscope.wtf/privkey.pem'),
         cert: fs.readFileSync('/etc/letsencrypt/live/kaleidoscope.wtf/fullchain.pem'),
         ca: fs.readFileSync('/etc/letsencrypt/live/kaleidoscope.wtf/chain.pem')
    }*/
    console.log('starting on 443');
    //var httpsServer = https.createServer(options, app);
    //httpsServer.listen(443);
    //httpServer.listen(80);
    //app.use(forceSSL);
}

console.log('['+config.name+'] starting on port',config.port);
httpServer.listen(config.port);

所以关键是我们按以下顺序检查路径

reqPath + ".html",
reqPath + "index.html",
reqPath

然后，如果它存在，那么我们会在响应中呈现它。这绝不是生产使用代码，因为它允许您进行目录遍历攻击，但这是为了让您了解您做错了什么以及应该如何处理它