0.34.6_repo_cleanup

src/web_server/filesystem.rs

@@ -7,9 +7,6 @@ use std::{
 #[cfg(unix)]
 use std::{ffi::CString, sync::Arc};
 
-/// Only filesystem state crosses into the blocking pool. Cloning an entire
-/// CompiledService here would also copy MIME, rewrite, PHP and security rules
-/// for every file or candidate opened during a request.
 pub(super) struct FilesystemRoot {
     root: PathBuf,
     symlink_policy: SymlinkPolicy,
@@ -83,11 +80,6 @@ pub(super) fn secure_open_sync(root: &FilesystemRoot, components: &[String]) ->
     use std::os::unix::io::{AsRawFd, FromRawFd};
 
     if components.is_empty() {
-        // `File::try_clone()` uses dup(2), which shares the directory offset with
-        // the persistent root descriptor. Passing such a clone to readdir(3)
-        // would leave the next root listing positioned at EOF. openat(".")
-        // creates a fresh open file description and therefore a fresh offset for
-        // every request while retaining the same O_NOFOLLOW confinement.
         let dot = cstring_component(".")?;
         let fd = unsafe {
             libc::openat(
@@ -103,16 +95,10 @@ pub(super) fn secure_open_sync(root: &FilesystemRoot, components: &[String]) ->
         let metadata = current.metadata()?;
         return Ok(Opened { file: current, metadata });
     }
-    // Borrow the already-owned root descriptor for the first openat. Opening a
-    // child does not change its directory offset, so a dup/close pair buys no
-    // isolation. Empty paths still open "." above for independent readdir state.
     let mut current: Option<File> = None;
     for (index, component) in components.iter().enumerate() {
         let name = cstring_component(component)?;
         let intermediate = index + 1 != components.len();
-        // The default remains O_NOFOLLOW on every component. `inside_root` is an
-        // explicit Linux-only opt-in: the opened descriptor is checked through
-        // /proc/self/fd after each resolution step before it can be used further.
         let mut flags = libc::O_RDONLY | libc::O_CLOEXEC;
         if root.symlink_policy == SymlinkPolicy::Deny {
             flags |= libc::O_NOFOLLOW;
@@ -120,7 +106,6 @@ pub(super) fn secure_open_sync(root: &FilesystemRoot, components: &[String]) ->
         if intermediate {
             flags |= libc::O_DIRECTORY;
         } else {
-            // Avoid blocking on special files. Only regular files/directories are served.
             flags |= libc::O_NONBLOCK;
         }
         let parent = current.as_ref().unwrap_or(root.root_handle.as_ref());
@@ -227,15 +212,10 @@ pub(super) fn list_directory_sync(
             continue;
         }
         let Ok(name) = std::str::from_utf8(name) else {
-            // Routing intentionally accepts only valid UTF-8, so do not emit an
-            // unusable or ambiguously decoded link for a non-UTF-8 file name.
             continue;
         };
         let mut child = components.to_vec();
         child.push(name.to_owned());
-        // Re-open through the root fd using the configured symlink policy. The
-        // default omits every symlink; Linux inside_root may include a target only
-        // after the opened descriptor has been proven to remain below the root.
         let Ok(child_opened) = secure_open_sync(root, &child) else {
             continue;
         };