Take the 2-minute tour ×
Code Review Stack Exchange is a question and answer site for peer programmer code reviews. It's 100% free, no registration required.

We've got a "catch-all" in app.js that renders a .jade file if it exists:

app.get('*', routes.render);

index.js

render: function(req, res) {
  fs.exists('views' + req.url + '.jade', function(exists) {
    if (exists) {
      //substring: "/admin" -> "admin"
      res.render(req.url.substring(1));
    } else {
      res.status(404);
      res.render('404', {url: req.url});
    }
  });
}

Problem is, we've either got to move everything we don't want rendered this way into another folder, which is a hassle, or create a manual blacklist. Is there a better way of doing this?

share|improve this question
    
I guess this is only for static pages? –  Florian Margaine Mar 1 '13 at 19:34
    
Only for pages that don't require additional parameters (for example "About Us") –  SomeKittens Mar 1 '13 at 19:45
add comment

1 Answer

Here are some examples of how most apps do:

  • Apache renders everything in the folder. If you want to hide access to a subfolder, you do that with an htaccess in this subfolder.
  • Define each route yourself. This'd mean having a whitelist in your case. (In some array or something.)
  • Keep the routes in the database. This allows you to handle permissions easily.

I haven't often seen the blacklist way. Why? Because of a simple security principle: blacklists may accidentally treat bad input as safe.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.