xf: single-file HTTP file transfer serverHEADmaster

Serve a directory tree over HTTP through one embedded page: a listing
with download links and a multi-file upload form.

Filesystem access is confined to the served root with os.Root, and
only regular files are served. Uploads are bounded by size and part
count, and every file is staged in the target directory before any is
renamed into place, so a refused or interrupted request leaves the
directory untouched.

Standard library only, no third-party dependencies.

1 files changed, 453 insertions, 0 deletions

diff --git a/main.go b/main.go
new file mode 100644
index 0000000..3fc9686
--- /dev/null
+++ b/main.go
@@ -0,0 +1,453 @@
+// Command xf (xfer) is a single-file HTTP file transfer server. Every
+// directory under the served root renders as one embedded web page that lists
+// its entries and accepts uploads into that directory; every file is served
+// for download.
+//
+// Usage:
+//
+//	xf [-addr address] [-dir directory] [-max-upload bytes]
+package main
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"flag"
+	"fmt"
+	"html/template"
+	"io"
+	"log"
+	"net"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+	"syscall"
+	"time"
+)
+
+const (
+	defaultMaxUpload = 1 << 30
+	maxUploadParts   = 1000
+	tempPrefix       = ".xf-upload-"
+
+	// readHeaderTimeout bounds a slow client without bounding the time it
+	// takes to stream a large upload body.
+	readHeaderTimeout = 10 * time.Second
+)
+
+var page = template.Must(template.New("index").Parse(indexHTML))
+
+// access logs downloads and uploads to standard output, kept separate from the
+// startup and error diagnostics the default logger writes to standard error.
+var access = log.New(os.Stdout, "", log.LstdFlags)
+
+type server struct {
+	root      *os.Root
+	maxUpload int64
+}
+
+type stagedFile struct {
+	name string
+	temp string
+	size int64
+}
+
+// countedBody counts the bytes read from the request body. multipart can turn
+// a MaxBytesReader error into a parse error, so the count, not the error,
+// decides whether an upload was refused for its size.
+type countedBody struct {
+	io.ReadCloser
+	bytes int64
+}
+
+func (body *countedBody) Read(p []byte) (int, error) {
+	n, err := body.ReadCloser.Read(p)
+	body.bytes += int64(n)
+	return n, err
+}
+
+type entry struct {
+	Name  string
+	Href  string
+	Size  string
+	IsDir bool
+}
+
+type pageData struct {
+	Dir     string // URL path of the listed directory
+	Parent  bool   // whether to link to the parent directory
+	Entries []entry
+}
+
+func main() {
+	addr := flag.String("addr", "127.0.0.1:8080", "listen address")
+	dir := flag.String("dir", ".", "directory to serve")
+	maxUpload := flag.Int64("max-upload", defaultMaxUpload,
+		"maximum bytes in one upload request")
+	flag.Parse()
+	if *maxUpload <= 0 {
+		log.Fatal("xf: -max-upload must be greater than zero")
+	}
+
+	rootName, err := filepath.Abs(*dir)
+	if err != nil {
+		log.Fatalf("xf: %v", err)
+	}
+	root, err := os.OpenRoot(rootName)
+	if err != nil {
+		log.Fatalf("xf: %v", err)
+	}
+
+	s := &server{root: root, maxUpload: *maxUpload}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /", s.handleGet)
+	mux.HandleFunc("POST /", s.handleUpload)
+
+	srv := &http.Server{
+		Addr:              *addr,
+		Handler:           mux,
+		ReadHeaderTimeout: readHeaderTimeout,
+	}
+
+	log.Printf("xf: serving %s on %s", rootName, *addr)
+	log.Fatalf("xf: %v", srv.ListenAndServe())
+}
+
+// resolve maps a request path to a path relative to the server root.
+func (s *server) resolve(urlPath string) string {
+	name := strings.TrimPrefix(path.Clean("/"+urlPath), "/")
+	if name == "" {
+		return "."
+	}
+	return filepath.FromSlash(name)
+}
+
+func (s *server) handleGet(w http.ResponseWriter, r *http.Request) {
+	rec := &recorder{ResponseWriter: w, status: http.StatusOK}
+	s.serve(rec, r)
+	access.Printf("get %q -> %d (%d bytes) from %s",
+		r.URL.Path, rec.status, rec.bytes, clientIP(r))
+}
+
+func (s *server) serve(w http.ResponseWriter, r *http.Request) {
+	name := s.resolve(r.URL.Path)
+	if isTempName(filepath.Base(name)) {
+		http.NotFound(w, r)
+		return
+	}
+	// O_NONBLOCK so that opening a FIFO cannot hang the handler; non-regular
+	// files are refused below.
+	f, err := s.root.OpenFile(name, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	switch {
+	case os.IsNotExist(err):
+		http.NotFound(w, r)
+		return
+	case os.IsPermission(err):
+		http.Error(w, "forbidden", http.StatusForbidden)
+		return
+	case err != nil:
+		// A path the root refuses, such as an escaping symlink or a
+		// component that is not a directory, is not a server fault.
+		log.Printf("xf: open %q: %v", r.URL.Path, err)
+		http.NotFound(w, r)
+		return
+	}
+	defer f.Close()
+	fi, err := f.Stat()
+	if err != nil {
+		log.Printf("xf: stat %q: %v", r.URL.Path, err)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+	if fi.IsDir() {
+		// Directory pages need a trailing slash so relative links work.
+		if !strings.HasSuffix(r.URL.Path, "/") {
+			http.Redirect(w, r, path.Clean(r.URL.Path)+"/", http.StatusMovedPermanently)
+			return
+		}
+		s.list(w, f, r.URL.Path)
+		return
+	}
+	if !fi.Mode().IsRegular() {
+		http.Error(w, "unsupported file type", http.StatusForbidden)
+		return
+	}
+	http.ServeContent(w, r, fi.Name(), fi.ModTime(), f)
+}
+
+func (s *server) list(w http.ResponseWriter, dir *os.File, urlPath string) {
+	dirents, err := dir.ReadDir(-1)
+	if err != nil {
+		log.Printf("xf: list %q: %v", urlPath, err)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+		return
+	}
+	sort.Slice(dirents, func(i, j int) bool {
+		if dirents[i].IsDir() != dirents[j].IsDir() {
+			return dirents[i].IsDir()
+		}
+		return dirents[i].Name() < dirents[j].Name()
+	})
+
+	entries := make([]entry, 0, len(dirents))
+	for _, de := range dirents {
+		if isTempName(de.Name()) {
+			continue
+		}
+		e := entry{
+			Name:  de.Name(),
+			Href:  (&url.URL{Path: de.Name()}).String(),
+			IsDir: de.IsDir(),
+		}
+		if de.IsDir() {
+			e.Href += "/"
+			e.Size = "-"
+		} else if fi, err := de.Info(); err == nil {
+			e.Size = humanSize(fi.Size())
+		} else {
+			e.Size = "?"
+		}
+		entries = append(entries, e)
+	}
+
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	data := pageData{Dir: urlPath, Parent: urlPath != "/", Entries: entries}
+	if err := page.Execute(w, data); err != nil {
+		log.Printf("xf: render: %v", err)
+	}
+}
+
+// handleUpload stages every file in the request before renaming any into
+// place, so a refused or interrupted upload leaves the directory untouched.
+func (s *server) handleUpload(w http.ResponseWriter, r *http.Request) {
+	dir, err := s.root.OpenRoot(s.resolve(r.URL.Path))
+	if err != nil {
+		http.Error(w, "not a directory", http.StatusNotFound)
+		return
+	}
+	defer dir.Close()
+	if r.ContentLength > s.maxUpload {
+		http.Error(w, "upload too large", http.StatusRequestEntityTooLarge)
+		return
+	}
+	body := &countedBody{ReadCloser: r.Body}
+	r.Body = http.MaxBytesReader(w, body, s.maxUpload)
+	mr, err := r.MultipartReader()
+	if err != nil {
+		http.Error(w, "bad upload: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+	var files []stagedFile
+	defer func() {
+		for _, file := range files {
+			dir.Remove(file.temp)
+		}
+	}()
+	names := make(map[string]bool)
+	parts := 0
+	for {
+		part, err := mr.NextPart()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			writeUploadError(w, err, http.StatusBadRequest, body.bytes > s.maxUpload)
+			return
+		}
+		parts++
+		if parts > maxUploadParts {
+			http.Error(w, "too many upload parts", http.StatusBadRequest)
+			return
+		}
+		if part.FileName() == "" {
+			continue // not a file part
+		}
+		// The client supplied name is reduced to its base component so an
+		// upload can never escape the directory.
+		name := filepath.Base(part.FileName())
+		if name == "/" || name == "." || name == ".." || isTempName(name) {
+			http.Error(w, fmt.Sprintf("invalid filename: %q", part.FileName()),
+				http.StatusBadRequest)
+			return
+		}
+		if names[name] {
+			http.Error(w, fmt.Sprintf("duplicate filename: %q", name),
+				http.StatusBadRequest)
+			return
+		}
+		names[name] = true
+		file, err := stage(dir, name, part)
+		if err != nil {
+			status := http.StatusInternalServerError
+			if errors.Is(err, io.ErrUnexpectedEOF) {
+				status = http.StatusBadRequest
+			}
+			writeUploadError(w, err, status, body.bytes > s.maxUpload)
+			return
+		}
+		files = append(files, file)
+	}
+	if len(files) == 0 {
+		http.Error(w, "no files in upload", http.StatusBadRequest)
+		return
+	}
+	for _, file := range files {
+		if err := dir.Rename(file.temp, file.name); err != nil {
+			log.Printf("xf: commit upload %q: %v", file.name, err)
+			http.Error(w, "upload failed", http.StatusInternalServerError)
+			return
+		}
+		access.Printf("upload %q (%d bytes) from %s",
+			path.Join(r.URL.Path, file.name), file.size, clientIP(r))
+	}
+	http.Redirect(w, r, r.URL.Path, http.StatusSeeOther)
+}
+
+// stage streams one upload into a temporary file in its target directory, so
+// that the commit is an atomic rename.
+func stage(dir *os.Root, name string, src io.Reader) (stagedFile, error) {
+	mode := os.FileMode(0o600)
+	fi, err := dir.Lstat(name)
+	switch {
+	case os.IsNotExist(err):
+	case err != nil:
+		return stagedFile{}, err
+	case !fi.Mode().IsRegular():
+		return stagedFile{}, fmt.Errorf("refusing to replace non-regular file %q", name)
+	default:
+		mode = fi.Mode().Perm()
+	}
+
+	var random [16]byte
+	if _, err := rand.Read(random[:]); err != nil {
+		return stagedFile{}, err
+	}
+	tmpName := tempPrefix + hex.EncodeToString(random[:])
+	tmp, err := dir.OpenFile(tmpName, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return stagedFile{}, err
+	}
+
+	n, err := io.Copy(tmp, src)
+	if err == nil {
+		err = tmp.Chmod(mode)
+	}
+	if cerr := tmp.Close(); err == nil {
+		err = cerr
+	}
+	if err != nil {
+		dir.Remove(tmpName)
+		return stagedFile{}, err
+	}
+	return stagedFile{name: name, temp: tmpName, size: n}, nil
+}
+
+func isTempName(name string) bool {
+	if len(name) != len(tempPrefix)+32 || !strings.HasPrefix(name, tempPrefix) {
+		return false
+	}
+	_, err := hex.DecodeString(strings.TrimPrefix(name, tempPrefix))
+	return err == nil
+}
+
+func writeUploadError(w http.ResponseWriter, err error, status int, tooLarge bool) {
+	switch {
+	case tooLarge:
+		http.Error(w, "upload too large", http.StatusRequestEntityTooLarge)
+	case status == http.StatusInternalServerError:
+		log.Printf("xf: upload: %v", err)
+		http.Error(w, "upload failed", status)
+	default:
+		http.Error(w, "bad upload: "+err.Error(), status)
+	}
+}
+
+// recorder captures the status and size of a response for the access log.
+type recorder struct {
+	http.ResponseWriter
+	status int
+	bytes  int64
+}
+
+func (rec *recorder) WriteHeader(code int) {
+	rec.status = code
+	rec.ResponseWriter.WriteHeader(code)
+}
+
+func (rec *recorder) Write(p []byte) (int, error) {
+	n, err := rec.ResponseWriter.Write(p)
+	rec.bytes += int64(n)
+	return n, err
+}
+
+func clientIP(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}
+
+func humanSize(n int64) string {
+	const unit = 1024
+	if n < unit {
+		return fmt.Sprintf("%d B", n)
+	}
+	div, exp := int64(unit), 0
+	for x := n / unit; x >= unit; x /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %ciB", float64(n)/float64(div), "KMGTPE"[exp])
+}
+
+const indexHTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>xf</title>
+<style>
+body { font-family: ui-monospace, monospace; max-width: 60rem; margin: 2rem auto; padding: 0 1rem; color: #111; }
+h1 { font-size: 1rem; font-weight: normal; color: #555; word-break: break-all; }
+form { margin: 1.5rem 0; padding: 1rem; border: 1px solid #ccc; }
+table { width: 100%; border-collapse: collapse; }
+td { text-align: left; padding: 0.3rem 0.5rem; border-bottom: 1px solid #eee; }
+td.size { text-align: right; white-space: nowrap; color: #555; }
+a { text-decoration: none; }
+a:hover { text-decoration: underline; }
+.empty { color: #999; }
+</style>
+</head>
+<body>
+<h1>xf: {{.Dir}}</h1>
+<form method="post" enctype="multipart/form-data">
+<input type="file" name="files" multiple required>
+<button type="submit">upload</button>
+</form>
+<table>
+<tbody>
+{{if .Parent}}
+<tr>
+<td><a href="../">../</a></td>
+<td class="size">-</td>
+</tr>
+{{end}}
+{{range .Entries}}
+<tr>
+<td><a href="{{.Href}}">{{.Name}}{{if .IsDir}}/{{end}}</a></td>
+<td class="size">{{.Size}}</td>
+</tr>
+{{else}}
+<tr><td class="empty" colspan="2">empty</td></tr>
+{{end}}
+</tbody>
+</table>
+</body>
+</html>
+`