v0.30.0

src/web_server/serve.rs

@@ -321,7 +321,7 @@ async fn serve_inner(
     }
     let service_for_list = service.clone();
     let components_for_list = components.clone();
-    let entries = match tokio::task::spawn_blocking(move || {
+    let mut entries = match tokio::task::spawn_blocking(move || {
         list_directory_sync(&service_for_list, &components_for_list)
     })
     .await
@@ -335,25 +335,27 @@ async fn serve_inner(
             )
         }
     };
-    let entries: Vec<_> = entries
-        .into_iter()
-        .filter(|entry| {
-            if htaccess::protected_component(service.htaccess.as_ref(), &entry.name) {
-                return false;
-            }
-            let child_path = if effective_path.ends_with('/') {
-                format!("{effective_path}{}", entry.name)
-            } else {
-                format!("{effective_path}/{}", entry.name)
-            };
-            !hardening_denied_path(service, &child_path)
-        })
-        .collect();
+    // Filtering in place avoids a second Vec allocation for large directories
+    // while retaining exactly the same visibility and hardening checks.
+    entries.retain(|entry| {
+        if htaccess::protected_component(service.htaccess.as_ref(), &entry.name) {
+            return false;
+        }
+        let child_path = if effective_path.ends_with('/') {
+            format!("{effective_path}{}", entry.name)
+        } else {
+            format!("{effective_path}/{}", entry.name)
+        };
+        !hardening_denied_path(service, &child_path)
+    });
     let listing = directory_listing(&effective_path, &entries);
+    let listing_bytes = listing.len();
     let mut response = Response::new(if method == Method::HEAD {
         Body::empty()
     } else {
-        Body::from(listing.clone())
+        // Move the generated listing into the response. Copying it doubles
+        // peak HTML allocation for large directory listings under load.
+        Body::from(listing)
     });
     response.headers_mut().insert(
         CONTENT_TYPE,
@@ -361,7 +363,7 @@ async fn serve_inner(
     );
     response.headers_mut().insert(
         CONTENT_LENGTH,
-        HeaderValue::from_str(&listing.len().to_string()).unwrap(),
+        HeaderValue::from_str(&listing_bytes.to_string()).unwrap(),
     );
     response
         .headers_mut()