← back to Flappy Flight

chore: harden dev server, v1.0.0 -> v1.0.1 (session close)

f89798c96fbb3600f3aa287c06ec5cacfebc2998 · 2026-07-24 07:27:49 -0700 · Steve Abrams

Lint pass on server.js: guard decodeURIComponent (malformed URL -> 400
instead of crash) and tighten the path-traversal check to ROOT+sep.
Game index.html unchanged (CDP-verified build left intact).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

• M package.json
• M server.js

Diff

commit f89798c96fbb3600f3aa287c06ec5cacfebc2998
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Jul 24 07:27:49 2026 -0700

    chore: harden dev server, v1.0.0 -> v1.0.1 (session close)
    
    Lint pass on server.js: guard decodeURIComponent (malformed URL -> 400
    instead of crash) and tighten the path-traversal check to ROOT+sep.
    Game index.html unchanged (CDP-verified build left intact).
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 package.json | 11 +++++++++--
 server.js    |  6 ++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 2bf19fc..3014c41 100644
--- a/package.json
+++ b/package.json
@@ -1,12 +1,19 @@
 {
   "name": "flappy-flight",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "A polished, self-contained Flappy-Bird-style game in a single HTML file. No assets, no libraries.",
   "scripts": {
     "start": "node server.js",
     "serve": "node server.js"
   },
-  "keywords": ["game", "flappy-bird", "canvas", "html5", "single-file", "no-dependencies"],
+  "keywords": [
+    "game",
+    "flappy-bird",
+    "canvas",
+    "html5",
+    "single-file",
+    "no-dependencies"
+  ],
   "license": "MIT",
   "private": true
 }
diff --git a/server.js b/server.js
index 416d1a4..b70e8b7 100644
--- a/server.js
+++ b/server.js
@@ -17,11 +17,13 @@ const TYPES = {
 };
 
 http.createServer((req, res) => {
-  let urlPath = decodeURIComponent(req.url.split('?')[0]);
+  let urlPath;
+  try { urlPath = decodeURIComponent(req.url.split('?')[0]); }
+  catch (e) { res.writeHead(400); res.end('Bad request'); return; }
   if (urlPath === '/') urlPath = '/index.html';
   // resolve inside ROOT only (no path traversal)
   const filePath = path.join(ROOT, path.normalize(urlPath));
-  if (!filePath.startsWith(ROOT)) {
+  if (!filePath.startsWith(ROOT + path.sep) && filePath !== ROOT) {
     res.writeHead(403); res.end('Forbidden'); return;
   }
   fs.readFile(filePath, (err, data) => {

← a17fd67 Flappy Flight — working single-file game + project scaffold  ·  back to Flappy Flight  ·  (newest)