The serveStatic plugin leaks file handles

[koute]

Currently the serveStatic plugin is affected by the following Node.js bug: nodejs/node#1834

If a client disconnects too early a file stream (and a file handle) will be leaked permanently, which allows anyone to trivially DoS any server that uses the serveStatic plugin.

Since it doesn't look like the Node.js bug is going to be fixed anytime soon it should be worked around here.

How to reproduce the issue

1. Create a public directory and put a non-empty index.html in it.

2. Run this as a server:

   var restify = require('restify');
   var plugins = require('restify-plugins');
   
   var server = restify.createServer({});
   
   server.use(plugins.acceptParser(server.acceptable));
   server.use(plugins.queryParser());
   server.use(plugins.bodyParser());
   
   server.listen(8091);
   server.get(/.*/, plugins.serveStatic({
     directory: './public'
   }));
   

3. Run this as a client:

   var net = require('net');
   var LEAKY = true;
   
   setInterval( function() {
       var socket = new net.Socket();
       socket.connect({host: '127.0.0.1', port: 8091}, function() {
           var DATA =
               "GET /index.html HTTP/1.1\r\n" +
               "Host: localhost:8091\r\n" +
               "User-Agent: curl/7.48.0\r\n" +
               "Accept: */*\r\n" +
               "\r\n";
   
           socket.write( DATA, 'utf-8', function() {
               if (LEAKY) {
                   socket.end();
               } else {
                   setTimeout( function() {
                       socket.end();
                   }, 10);
               }
           });
       });
   }, 100);
   

4. Run watch -n 0.1 "stat /proc/$server_pid/fd/* | grep File | wc -l"; the number of open file handles will continue to grow indefinitely.

5. If you change LEAKY to false then the issue will stop reproducing.

Versions

restify 4.1.1, restify-plugins 1.0.2

[DonutEspresso]

Thanks for the report! Appreciate the concrete examples and repro case.

[koute]

@DonutEspresso I'm going to create a PR momentarily that fixes this; just FYI so that you don't waste your time fixing it yourself. (: