Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

zeroserver.io

Post reply on HN
Print view View original

31–40 of 256 posts

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#31

Post by q3k »

untog wrote: post #28
q3k wrote: post #26

> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…

...why? I get that file-system based routing means you know the location of a source file on disk, but if anyone can access that file you've already lost. And auto-dependency resolution also doesn't seem any larger a security concern, all it's doing is skipping an "npm install" command.

Because if you ever have a broken upload system that allows you to drop a JS file somewhere accessible by the file system routing, you have remote code execution. Additionally, you now have to write guards in every non-endpoint JS file so that it doesn't get executed just by a misplaced HTTP request.

And as for automatic dependency resolution, this means you're not even aware of what transitive dependencies you're pulling in, what version they are and have no way to vet anything - everything is hidden behind a wall of magic.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#32

Post by asadlionpk »

desmondl wrote: post #25

Are there any plans to make this support Typescript in the future? :)

Yes. Should be easy! As we are not a typescript shop yet, we might need a hand with that. Otherwise, I will try to figure it out soon.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#34

Post by aboutruby »

untog wrote: post #28
q3k wrote: post #26

> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…

...why? I get that file-system based routing means you know the location of a source file on disk, but if anyone can access that file you've already lost. And auto-dependency resolution also doesn't seem any larger a security concern, all it's doing is skipping an "npm install" command.

Probably having .htaccess / .env / database configuration / files that are not supposed to be public be exposed.

For instance, Rails has a public/ folder for files that are going to be served. And jekyll hides files by pattern-matching them[1].

Zero doesn't seem to have exclude folders by default. The solution would be to run Zero is a subfoler and require file in the parent folder which would act as the tree's root.

[1]: https://help.github.com/en/articles/files-that-start-with-an...

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#36

Post by sjroot »

sjroot wrote: post #33

Is there any way to "ignore" specific files or directories? For example, I want to reuse React components across different routes (exposed as jsx files). However, I don't want `mysite.com/components/Container` to be a valid endpoint.

I would propose adding support for a 'zeroignore' file to handle this. :)

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#37

Post by asadlionpk »

sjroot wrote: post #33

Is there any way to "ignore" specific files or directories? For example, I want to reuse React components across different routes (exposed as jsx files). However, I don't want `mysite.com/components/Container` to be a valid endpoint.

Yes. It's not written in docs yet but any file or folder starting with _ (underscore) is not exposed publicly. This feature spec is still open for discussion as on how to tackle it the best.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#39

Post by sjroot »

asadlionpk wrote: post #37
sjroot wrote: post #33

Is there any way to "ignore" specific files or directories? For example, I want to reuse React components across different routes (exposed as jsx files). However, I don't want `mysite.com/components/Container` to be a valid endpoint.

Yes. It's not written in docs yet but any file or folder starting with _ (underscore) is not exposed publicly. This feature spec is still open for discussion as on how to tackle it the best.

Check my reply to this comment. The underscore idea was one of the first things to come to mind too, but I think having a specific file makes it clear to others who might not understand Zero internals.

Re: Show HN: Zero – A fast, zero-configuration server for React, Node.js, Markdown

#40

Post by gpmcadam »

q3k wrote: post #26

> File-system Based Routing: If your code resides in ./api/login.js it's exposed at /api/login" rel="nofollow">http:// /api/login . Inspired by good ol' PHP days. > Auto Dependency Resolution: If a file does require('underscore'), it is automatically installed and resolved. You can always create your own package.json file to install a specific version of a package. This sounds like a security nightmare. EDIT: to be c…

Just like "good ol' PHP days!" as the docs say :D
Post reply on HN