Welcome to SVR.JS 3.0.0
If you see this page, that means, that the server is properly working. You can further configure the server and replace index.html and test.html pages with custom ones.
Default config.json looks like this:
{
"users": [],
"port": 80,
"pubport": 80,
"page404": "404.html",
"timestamp": 1680954429282,
"blacklist": [],
"nonStandardCodes": [],
"enableCompression": true,
"customHeaders": {},
"enableHTTP2": false,
"enableLogging": true,
"enableDirectoryListing": true,
"enableDirectoryListingWithDefaultHead": false,
"serverAdministratorEmail": "[no contact information]",
"stackHidden": false,
"enableRemoteLogBrowsing": true,
"exposeServerVersion": true,
"disableServerSideScriptExpose": false,
"rewriteMap": [
{
"definingRegex": "/\\/invoke500\\/\\?/",
"replacements": [
{
"regex": "/\\/invoke500\\/\\?/",
"replacement": "/invoke500.svr?"
}
]
},
{
"definingRegex": "/\\/invoke500\\/.+\\//",
"replacements": [
{
"regex": "/\\/\\?/",
"replacement": "&"
},
{
"regex": "/invoke500\\//",
"replacement": "invoke500.svr?"
},
{
"regex": "/\\/(?!invoke500.svr?)/",
"replacement": ""
}
]
},
{
"definingRegex": "/\\/invoke500\\/.+/",
"replacements": [
{
"regex": "/\\?/",
"replacement": "&"
},
{
"regex": "/invoke500\\//",
"replacement": "invoke500.svr?"
}
]
},
{
"definingRegex": "/\\/invoke500\\//",
"replacements": [
{
"regex": "/\\/invoke500\\//",
"replacement": "/invoke500.svr"
}
]
},
{
"definingRegex": "/\\/invoke500$/",
"replacements": [
{
"regex": "/\\/invoke500/",
"replacement": "/invoke500.svr"
}
]
}
],
"allowStatus": true,
"dontCompress": ["/.*\\.ipxe$/","/.*\\.img$/","/.*\\.iso$/"],
"enableIPSpoofing": false,
"secure": false,
"sni": {},
"disableNonEncryptedServer": false,
"disableToHTTPSRedirect": false
}
Changes (from SVR.JS 2.1.2):
- 502 errors now logs their stacks.
- Added better exception handler.
- Added callServerError function for use in server-side JavaScript and mods.
- Added cluster+ipc shim used when SVR.JS is running on Bun (SVR.JS can now run multi-threaded on Bun).
- Added command-line parameter: -v/--version.
- Added Content-Range support for static files.
- Added custom Expect header handler.
- Added custom request parse error handler.
- Added date and time to logs.
- Added --disable-mods option. (disables all mods and server side JavaScript)
- Added displaying of contact information on 500 error.
- Added experimental support for Bun (no SVR.JS command line for now...).
- Added HTTP status code message to logs.
- Added new command-line option: --single-threaded
- Added new config.json properties: sni, serverAdministratorEmail, stackHidden, enableRemoteLogBrowsing, dontCompress, enableIPSpoofing, allowStatus, disableServerSideScriptExpose, exposeServerVersion, rewriteMap, secure, wwwroot, disableNonEncryptedServer and disableToHTTPSRedirect.
- Added new depedency - formidable.
- Added new method callable from mods: getCustomHeaders (gets headers from config.json file along with "Server" header).
- Added new mod methods - getCustomHeaders, origHref, parsePostData and redirect.
- Added new server-side JavaScript fields - customvar1, customvar2, customvar3, customvar4.
- Added new utility: log highlighter at loghighlighter.js
- Added new utility: log viewer at logviewer.js
- Added new utility: SVR.JS user utility at svrpasswd.js
- Added option to disable HTTP => HTTPS redirect server.
- Added option to listen only for HTTPS.
- Added {path} directive in custom error pages and headers.
- Added RegEx support for non-standard error codes.
- Added request ID to logs.
- Added server error descriptions.
- Added SNI support.
- Added status page at /svrjsstatus.svr.
- Added support for CIDR notation in non-standard codes.
- Added support for CONNECT method (along with mod callbacks).
- Added support for HTTP authentication.
- Added support for RegEx for nonStandardCodes property.
- Added support for X-Forwarded-For header.
- Added URL rewriting.
- Added warning, when SVR.JS is run as root.
- Addedd error message in case SVR.JS is attempted to be started without Node.JS.
- Allowed Node.JS versions without HTTP/2 support. (although HTTP/2 will not work)
- Allowed starting without Internet connection.
- Attackers can no longer bypass content blocking mechanism (non-standard codes set in config.json), when SVR.JS is run in Windows.
- Attackers can no longer bypass content blocking mechanism, when SVR.JS is run in Windows.
- Bare minimum now requires only "svr.js" script and node_modules directory.
- Broken server availability addresses are now invisible in the console.
- Change of working directory is now possible.
- Changed demo server-side JavaScript to use new callServerError function.
- Changed file type icons.
- Changed HTTP error descriptions.
- Changed log format.
- Changed logo to new one.
- Changed SVR.JS log descriptions.
- config.json options which are not used by SVR.JS are now kept.
- Configuration file now has diffrent placeholder content.
- Connection messages when using SVR.JS as proxy aren't longer broken.
- Connection with null req.socket are now dropped.
- Corrected handling of multi-line log messages.
- Custom headers are no longer set by default on proxy requests.
- DEBUG: /crash.svr crashes the server (only in Nightly).
- Default content type can be no longer set.
- Deprecated config.json property: defaultpage.
- Directory listing custom foots now are displayed even if foot.html file doesn't exist.
- Directory listing custom heads now are displayed even if head.html file doesn't exist.
- Directory listing no longer breaks with "<" and ">" characters (XSS mitigated).
- Directory listing now shows original URL, when URL is rewritten.
- Directory listing now shows whatever the file is block device, chacter device, FIFO or socket.
- Directory traversal through symbolic links is no longer possible (new URL sanitation function).
- Disabled HTTP compression for w3m and Netscape 4.x.
- Error pages can use new format: .<error_code> instead of <error_code>.html.
- Error stack can be now hidden using stackHidden property.
- Factory reset no longer replaces config.json with placeholder one.
- Files without extension are no longer presented as HTML content.
- Fixed bug: Blacklist didn't save into config.json file.
- Fixed bug: Downloading files above 2GB now works properly.
- Fixed bug: Next thread no longer starts after closing ports.
- Fixed bug related to broken access controls in SVR.JS when it's run in Windows.
- Fixed bug with server version exposure.
- Fixed crash on malformed public IP check response.
- Fixed crashes with TCP resets, when using default handler for CONNECT method.
- Fixed default config.json file.
- Fixed directory listing, when URL contains "@" or "?"
- Fixed filterHeaders method.
- Fixed handling of some proxy requests by default redirect server.
- Fixed HEAD method handling.
- Fixed HTTP compression.
- Fixed master process crash, when unable to fork process.
- Fixed process crash, when unable to save to a log file.
- Fixed proxy mod loader.
- Fixed public IP address identification on server console.
- Fixed security vulnerability: Attacker could append "%00" to URL to bypass access restrictions when SVR.JS is running on Bun.
- Fixed security vulnerability: Attacker could send specially constructed HTTP request to bypass content block mechanism.
- Fixed security vulnerability: Attacker could used encoded characters to bypass access restrictions.
- Fixed server endlessly spawning threads in Node.JS 20.x.
- Fixed SVR.JS not able to start in Android (d/node.js).
- Fixed SVR.JS not able to start in Node.JS 16.x in Haiku OS.
- Fixed URL mojibake.
- Fixed website block, when SVR.JS is running on Bun
- Fixed XSS bug in host name indication in default error pages.
- HTTP => HTTPS redirect server now returns 400 error when no host is specified.
- HTTP requests made to HTTPS server now return 497 error page.
- HTTP requests using CONNECT method now return 501 error, if SVR.JS is run on Bun.
- Icons on directory listings are no longer stretched, when padding is applies to the table.
- Improved bad request handler.
- Improved compatibility with Bun.
- Improved compatibility with Node.JS 20.x.
- Improved default error pages and directory listings for mobile devices.
- Improved directory listings.
- Improved file handling by URL.
- Improved handling of 405 error.
- Improved handling of OPTIONS method.
- Improved HTTP => HTTPS redirect handler.
- Improved HTTP/2 => HTTP/1.x translation API.
- Improved possible server access URLs.
- IPv6 URLs are now shown properly.
- Links now show sizes of referenced file in directory listing.
- Logs are no longer remotely accessible, when enableRemoteLogBrowsing is set to false.
- Made HTTP => HTTPS redirect server more compatible with Node.JS 20.x.
- Main script moved to "svr.js" file.
- Many request problem will now result in 500 error instead of crash.
- Mitigated path traversal at bad URL rewriting.
- Mod loader no longer uses eval.
- Node.JS version is now exposed in Server header (unless exposeServerVersion is false).
- Non-standard codes no longer works on proxy requests.
- Patched supplied fs-minipass module to work with Bun.
- Removed strict depedencies for: tar, svrmodpack, hexstrbase64 and formidable.
- Removed "Welcome to DorianTech Node.JS Server!" and "Goodbye." log, rendering welcomeMessage property useless.
- Replaced 403 error page specific to disabled directory listing with generic one.
- Replaced "domian" property with "domain" in config.json.
- Replaced URL sanitation algorithm with faster one.
- Server is now more protected against directory traversal attack.
- Server no longer crashes on some malformed URIs.
- Server now returns 403 error, when server software itself doesn't have permissions to access files.
- Size function now requires pretty-bytes library.
- Size function now uses custom fallback.
- Stack traces from 500 errors are now displayed in logs.
- SVR.JS doesn't use template config.json anymore, if config.json doesn't exist
- SVR.JS no longer crashes on mod loading problem.
- SVR.JS no longer crashes when displaying listing of directory containing invalid files.
- SVR.JS no longer drops connections having null response socket.
- SVR.JS now keeps unused properties of config.json file.
- SVR.JS used as HTTPS server works even without key and cert fields in config.json.
- SVR.JS version is no longer leaked via svr.js file, when exposeServerVersion property is set to false.
- Updated supplied mime-types and mime-db modules.
- Using SVR.JS as an proxy without proxy mod now returns no-proxy message.
Bugs:
- Some very old mods requiring hexstrbase64 will fail to load.
- On first load server-side JavaScript will fail to load when SVR.JS is running on Bun.
Tests
Licenses
SVR.JS status page
More Information
