Checked for existence of page via a network request

refs https://github.com/TryGhost/Team/issues/2466

Now that we're checking for resources at the URL and rejecting if
there isn't one found, we want to make sure that we can handle pages
which are not a resource.

The idea here is to make a HEAD request to determine whether or not
the page exists. We don't need the full response so HEAD saves us some
bandwidth and we allow both 2xx and 3xx status codes because Ghost has
redirects to add missing trailing slashes, which may not be present in
the URL we're passed.

ghost/core/core/server/services/mentions/RoutingService.js

@@ -1,3 +1,5 @@
+const logging = require('@tryghost/logging');
+
 /**
  * @typedef {import('@tryghost/webmentions/lib/MentionsAPI').IRoutingService} IRoutingService
  * @typedef {import('@tryghost/webmentions/lib/MentionsAPI').IResourceService} IResourceService
@@ -19,6 +21,9 @@ module.exports = class RoutingService {
     /** @typedef {IResourceService} */
     #resourceService;
 
+    /** @typedef {import('got')} */
+    #externalRequest;
+
     /**
      * @param {object} deps
      * @param {URL} deps.siteUrl
@@ -28,6 +33,7 @@ module.exports = class RoutingService {
     constructor(deps) {
         this.#siteUrl = deps.siteUrl;
         this.#resourceService = deps.resourceService;
+        this.#externalRequest = deps.externalRequest;
     }
 
     /**
@@ -48,7 +54,19 @@ module.exports = class RoutingService {
             return true;
         }
 
-        return false;
+        try {
+            const response = await this.#externalRequest.head(url, {
+                followRedirect: false
+            });
+            if (response.statusCode < 400 && response.statusCode > 199) {
+                return true;
+            } else {
+                return false;
+            }
+        } catch (err) {
+            logging.error(err);
+            return false;
+        }
     }
 };
 

ghost/core/core/server/services/mentions/service.js

@@ -36,7 +36,8 @@ module.exports = {
         });
         const routingService = new RoutingService({
             siteUrl: new URL(urlUtils.getSiteUrl()),
-            resourceService
+            resourceService,
+            externalRequest
         });
 
         const api = new MentionsAPI({

ghost/core/test/unit/server/services/mentions/RoutingService.test.js

@@ -1,9 +1,15 @@
 const assert = require('assert');
 const sinon = require('sinon');
+const nock = require('nock');
+const got = require('got');
 const ObjectID = require('bson-objectid').default;
 const RoutingService = require('../../../../../core/server/services/mentions/RoutingService');
 
 describe('RoutingService', function () {
+    afterEach(function () {
+        sinon.restore();
+        nock.cleanAll();
+    });
     describe('pageExists', function () {
         describe('URL checks', function () {
             it('Returns false if the url is from a different origin', async function () {
@@ -13,7 +19,8 @@ describe('RoutingService', function () {
                 };
                 const routingService = new RoutingService({
                     siteUrl,
-                    resourceService
+                    resourceService,
+                    externalRequest: got
                 });
 
                 const result = await routingService.pageExists(new URL('https://different-website.com'));
@@ -28,7 +35,8 @@ describe('RoutingService', function () {
                 };
                 const routingService = new RoutingService({
                     siteUrl,
-                    resourceService
+                    resourceService,
+                    externalRequest: got
                 });
 
                 checkNoSubdomain: {
@@ -53,38 +61,92 @@ describe('RoutingService', function () {
                 };
                 const routingService = new RoutingService({
                     siteUrl,
-                    resourceService
+                    resourceService,
+                    externalRequest: got
                 });
 
-                resourceService.getByURL.resolves({type: 'post', id: new ObjectID});
+                resourceService.getByURL.resolves({pe: 'post', id: new ObjectID});
 
                 const result = await routingService.pageExists(new URL('https://website.com/subdir/post'));
                 assert.equal(result, true);
             });
+        });
 
-            it('Returns false if the url is on the correct origin and subdirectory and a resource does not exist', async function () {
+        describe('Network checks', function () {
+            it('Returns true if the URL responds with a 200 status code to a HEAD request', async function () {
                 const siteUrl = new URL('https://website.com/subdir');
                 const resourceService = {
                     getByURL: sinon.stub()
                 };
                 const routingService = new RoutingService({
                     siteUrl,
-                    resourceService
+                    resourceService,
+                    externalRequest: got
                 });
 
                 resourceService.getByURL.resolves(null);
 
-                checkJustSubdomain: {
-                    const result = await routingService.pageExists(new URL('https://website.com/subdir'));
-                    assert.equal(result, false);
-                    break checkJustSubdomain;
-                }
+                nock('https://website.com').head('/subdir/should-exist').reply(200);
 
-                checkLongerPath: {
-                    const result = await routingService.pageExists(new URL('https://website.com/subdir/page'));
-                    assert.equal(result, false);
-                    break checkLongerPath;
-                }
+                const result = await routingService.pageExists(new URL('https://website.com/subdir/should-exist'));
+                assert.equal(result, true);
+            });
+
+            it('Returns true if the URL responds with a 301 status code to a HEAD request', async function () {
+                const siteUrl = new URL('https://website.com/subdir');
+                const resourceService = {
+                    getByURL: sinon.stub()
+                };
+                const routingService = new RoutingService({
+                    siteUrl,
+                    resourceService,
+                    externalRequest: got
+                });
+
+                resourceService.getByURL.resolves(null);
+
+                nock('https://website.com').head('/subdir/should-redirect').reply(301);
+
+                const result = await routingService.pageExists(new URL('https://website.com/subdir/should-redirect'));
+                assert.equal(result, true);
+            });
+
+            it('Returns false if the URL responds with a 404 status code to a HEAD request', async function () {
+                const siteUrl = new URL('https://website.com/subdir');
+                const resourceService = {
+                    getByURL: sinon.stub()
+                };
+                const routingService = new RoutingService({
+                    siteUrl,
+                    resourceService,
+                    externalRequest: got
+                });
+
+                resourceService.getByURL.resolves(null);
+
+                nock('https://website.com').head('/subdir/not-exist').reply(404);
+
+                const result = await routingService.pageExists(new URL('https://website.com/subdir/not-exist'));
+                assert.equal(result, false);
+            });
+
+            it('Returns false if the URL responds with a 500 status code to a HEAD request', async function () {
+                const siteUrl = new URL('https://website.com/subdir');
+                const resourceService = {
+                    getByURL: sinon.stub()
+                };
+                const routingService = new RoutingService({
+                    siteUrl,
+                    resourceService,
+                    externalRequest: got
+                });
+
+                resourceService.getByURL.resolves(null);
+
+                nock('https://website.com').head('/subdir/big-error').reply(500);
+
+                const result = await routingService.pageExists(new URL('https://website.com/subdir/big-error'));
+                assert.equal(result, false);
             });
         });
     });