Render arbitrary jade in express

Question

We've got a "catch-all" in app.js that renders a .jade file if it exists:

app.get('*', routes.render);

index.js

render: function(req, res) {
 fs.exists('views' + req.url + '.jade', function(exists) {
 if (exists) {
 //substring: "/admin" -> "admin"
 res.render(req.url.substring(1));
 } else {
 res.status(404);
 res.render('404', {url: req.url});
 }
 });
}

Problem is, we've either got to move everything we don't want rendered this way into another folder, which is a hassle, or create a manual blacklist. Is there a better way of doing this?

• Florian Margaine: I guess this is only for static pages?
• SomeKittens: Only for pages that don't require additional parameters (for example "About Us")

Answer 1

Here are some examples of how most apps do:

• Apache renders everything in the folder. If you want to hide access to a subfolder, you do that with an htaccess in this subfolder.
• Define each route yourself. This'd mean having a whitelist in your case. (In some array or something.)
• Keep the routes in the database. This allows you to handle permissions easily.

I haven't often seen the blacklist way. Why? Because of a simple security principle: blacklists may accidentally treat bad input as safe.