add an index.html to the static api

rust-lang · Dec 13, 2024 · 1c723ed · 1c723ed
1 parent 9e7672b
commit 1c723ed
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 8 deletions.
diff --git a/src/static_api.rs b/src/static_api.rs
@@ -34,6 +34,7 @@ impl<'a> Generator<'a> {
         self.generate_rfcbot()?;
         self.generate_zulip_map()?;
         self.generate_people()?;
+        self.generate_index_html()?;
         Ok(())
     }
 
@@ -423,20 +424,36 @@ impl<'a> Generator<'a> {
         Ok(())
     }
 
+    fn generate_index_html(&self) -> Result<(), Error> {
+        const CONTENT: &[u8] = b"\
+            <!DOCTYPE html>\n\
+            <meta charset=\"utf-8\">\n\
+            <p>See <a href=\"https://github.com/rust-lang/team\">rust-lang/team</a>.</p>\n\
+        ";
+
+        // GitHub has a security issue where a domain can point to GitHub Pages without any
+        // repository attached to it. In that case, anyone can attach their own (malicious)
+        // repo to the domain, effectively taking over it.
+        //
+        // This is not a problem for us, because team-api.infra.rust-lang.org does have content
+        // (generated by this module!). Unfortunately, when there is no repo attached to a domain
+        // GitHub serves the same 404 page as if there is no index.html file. This leads to *many*
+        // people running automated scanners and emailing [email protected] claiming they
+        // found a severe vulnerability and asking for a bounty.
+        //
+        // So let's just generate an index.html and reduce the volume of bogus reports.
+
+        info!("writing index.html...");
+        self.write("index.html", CONTENT)
+    }
+
     fn add<T>(&self, path: &str, obj: &T) -> Result<(), Error>
     where
         T: serde::Serialize + serde::de::DeserializeOwned + PartialEq,
     {
         info!("writing API object {}...", path);
-        let dest = self.dest.join(path);
-        if let Some(parent) = dest.parent() {
-            if !parent.exists() {
-                std::fs::create_dir_all(parent)?;
-            }
-        }
-
         let json = serde_json::to_string_pretty(obj)?;
-        std::fs::write(&dest, json.as_bytes())?;
+        self.write(path, json.as_bytes())?;
 
         let obj2: T =
             serde_json::from_str(&json).with_context(|| format!("failed to deserialize {path}"))?;
@@ -447,4 +464,15 @@ impl<'a> Generator<'a> {
 
         Ok(())
     }
+
+    fn write(&self, path: &str, bytes: &[u8]) -> Result<(), Error> {
+        let dest = self.dest.join(path);
+        if let Some(parent) = dest.parent() {
+            if !parent.exists() {
+                std::fs::create_dir_all(parent)?;
+            }
+        }
+        std::fs::write(&dest, bytes)?;
+        Ok(())
+    }
 }
diff --git a/tests/static-api/_expected/index.html b/tests/static-api/_expected/index.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<p>See <a href="https://github.com/rust-lang/team">rust-lang/team</a>.</p>