@fastify/static 7.0.3 → 8.0.0-pre.fv5.1

package/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ on:
 
 jobs:
   test:
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v3
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5.0.0
     with:
       license-check: true
       lint: true

package/README.md

@@ -477,13 +477,13 @@ If an error occurs while trying to send a file, the error will be passed
 to Fastify's error handler. You can set a custom error handler with
 [`fastify.setErrorHandler()`](https://fastify.dev/docs/latest/Reference/Server/#seterrorhandler).
 
-### Payload `stream.filename`
+### Payload `stream.path`
 
-If you need to access the filename inside the `onSend` hook, you can use `payload.filename`.
+If you need to access the file path inside the `onSend` hook, you can use `payload.path`.
 
 ```js
 fastify.addHook('onSend', function (req, reply, payload, next) {
-  console.log(payload.filename)
+  console.log(payload.path)
   next()
 })
 ```

package/index.js

@@ -1,6 +1,5 @@
 'use strict'
 
-const { PassThrough } = require('node:stream')
 const path = require('node:path')
 const { fileURLToPath } = require('node:url')
 const { statSync } = require('node:fs')
@@ -121,7 +120,7 @@ async function fastifyStatic (fastify, opts) {
       })
       if (opts.redirect === true && prefix !== opts.prefix) {
         fastify.get(opts.prefix, routeOpts, (req, reply) => {
-          reply.redirect(301, getRedirectUrl(req.raw.url))
+          reply.redirect(getRedirectUrl(req.raw.url), 301)
         })
       }
     } else {
@@ -170,7 +169,7 @@ async function fastifyStatic (fastify, opts) {
 
   const allowedPath = opts.allowedPath
 
-  function pumpSendToReply (
+  async function pumpSendToReply (
     request,
     reply,
     pathname,
@@ -221,164 +220,149 @@ async function fastifyStatic (fastify, opts) {
       }
     }
 
-    const stream = send(request.raw, pathnameForSend, options)
-    let resolvedFilename
-    stream.on('file', function (file) {
-      resolvedFilename = file
-    })
-
-    const wrap = new PassThrough({
-      flush (cb) {
-        this.finished = true
-        if (reply.raw.statusCode === 304) {
-          reply.send('')
+    // `send(..., path, ...)` will URI-decode path so we pass an encoded path here
+    const {
+      statusCode,
+      headers,
+      stream,
+      type,
+      metadata
+    } = await send(request.raw, encodeURI(pathnameForSend), options)
+    switch (type) {
+      case 'directory': {
+        const path = metadata.path
+        if (opts.list) {
+          await dirList.send({
+            reply,
+            dir: path,
+            options: opts.list,
+            route: pathname,
+            prefix,
+            dotfiles: opts.dotfiles
+          }).catch((err) => reply.send(err))
         }
-        cb()
-      }
-    })
 
-    wrap.getHeader = reply.getHeader.bind(reply)
-    wrap.setHeader = reply.header.bind(reply)
-    wrap.removeHeader = () => {}
-    wrap.finished = false
+        if (opts.redirect === true) {
+          try {
+            reply.redirect(getRedirectUrl(request.raw.url), 301)
+          } /* c8 ignore start */ catch (error) {
+            // the try-catch here is actually unreachable, but we keep it for safety and prevent DoS attack
+            await reply.send(error)
+          } /* c8 ignore stop */
+        } else {
+          // if is a directory path without a trailing slash, and has an index file, reply as if it has a trailing slash
+          if (!pathname.endsWith('/') && findIndexFile(pathname, options.root, options.index)) {
+            return pumpSendToReply(
+              request,
+              reply,
+              pathname + '/',
+              rootPath,
+              undefined,
+              undefined,
+              checkedEncodings
+            )
+          }
 
-    Object.defineProperty(wrap, 'filename', {
-      get () {
-        return resolvedFilename
-      }
-    })
-    Object.defineProperty(wrap, 'statusCode', {
-      get () {
-        return reply.raw.statusCode
-      },
-      set (code) {
-        reply.code(code)
+          reply.callNotFound()
+        }
+        break
       }
-    })
-
-    if (request.method === 'HEAD') {
-      wrap.on('finish', reply.send.bind(reply))
-    } else {
-      wrap.on('pipe', function () {
-        if (encoding) {
-          reply.header('content-type', getContentType(pathname))
-          reply.header('content-encoding', encoding)
+      case 'error': {
+        if (
+          statusCode === 403 &&
+          (!options.index || !options.index.length) &&
+          pathnameForSend[pathnameForSend.length - 1] === '/'
+        ) {
+          if (opts.list) {
+            await dirList.send({
+              reply,
+              dir: dirList.path(opts.root, pathname),
+              options: opts.list,
+              route: pathname,
+              prefix,
+              dotfiles: opts.dotfiles
+            }).catch((err) => reply.send(err))
+          }
         }
-        reply.send(wrap)
-      })
-    }
-
-    if (setHeaders !== undefined) {
-      stream.on('headers', setHeaders)
-    }
 
-    stream.on('directory', function (_, path) {
-      if (opts.list) {
-        dirList.send({
-          reply,
-          dir: path,
-          options: opts.list,
-          route: pathname,
-          prefix,
-          dotfiles: opts.dotfiles
-        }).catch((err) => reply.send(err))
-        return
-      }
+        if (metadata.error.code === 'ENOENT') {
+        // when preCompress is enabled and the path is a directory without a trailing slash
+          if (opts.preCompressed && encoding) {
+            const indexPathname = findIndexFile(pathname, options.root, options.index)
+            if (indexPathname) {
+              return pumpSendToReply(
+                request,
+                reply,
+                pathname + '/',
+                rootPath,
+                undefined,
+                undefined,
+                checkedEncodings
+              )
+            }
+          }
 
-      if (opts.redirect === true) {
-        try {
-          reply.redirect(301, getRedirectUrl(request.raw.url))
-        } catch (error) {
-          // the try-catch here is actually unreachable, but we keep it for safety and prevent DoS attack
-          /* istanbul ignore next */
-          reply.send(error)
-        }
-      } else {
-        // if is a directory path without a trailing slash, and has an index file, reply as if it has a trailing slash
-        if (!pathname.endsWith('/') && findIndexFile(pathname, options.root, options.index)) {
-          return pumpSendToReply(
-            request,
-            reply,
-            pathname + '/',
-            rootPath,
-            undefined,
-            undefined,
-            checkedEncodings
-          )
-        }
+          // if file exists, send real file, otherwise send dir list if name match
+          if (opts.list && dirList.handle(pathname, opts.list)) {
+            await dirList.send({
+              reply,
+              dir: dirList.path(opts.root, pathname),
+              options: opts.list,
+              route: pathname,
+              prefix,
+              dotfiles: opts.dotfiles
+            }).catch((err) => reply.send(err))
+            return
+          }
 
-        reply.callNotFound()
-      }
-    })
+          // root paths left to try?
+          if (Array.isArray(rootPath) && rootPathOffset < (rootPath.length - 1)) {
+            return pumpSendToReply(request, reply, pathname, rootPath, rootPathOffset + 1)
+          }
 
-    stream.on('error', function (err) {
-      if (err.code === 'ENOENT') {
-        // when preCompress is enabled and the path is a directory without a trailing slash
-        if (opts.preCompressed && encoding) {
-          const indexPathname = findIndexFile(pathname, options.root, options.index)
-          if (indexPathname) {
+          if (opts.preCompressed && !checkedEncodings.has(encoding)) {
+            checkedEncodings.add(encoding)
             return pumpSendToReply(
               request,
               reply,
-              pathname + '/',
+              pathnameOrig,
               rootPath,
-              undefined,
+              rootPathOffset,
               undefined,
               checkedEncodings
             )
           }
-        }
 
-        // if file exists, send real file, otherwise send dir list if name match
-        if (opts.list && dirList.handle(pathname, opts.list)) {
-          dirList.send({
-            reply,
-            dir: dirList.path(opts.root, pathname),
-            options: opts.list,
-            route: pathname,
-            prefix,
-            dotfiles: opts.dotfiles
-          }).catch((err) => reply.send(err))
-          return
+          return reply.callNotFound()
         }
 
-        // root paths left to try?
-        if (Array.isArray(rootPath) && rootPathOffset < (rootPath.length - 1)) {
-          return pumpSendToReply(request, reply, pathname, rootPath, rootPathOffset + 1)
+        // The `send` library terminates the request with a 404 if the requested
+        // path contains a dotfile and `send` is initialized with `{dotfiles:
+        // 'ignore'}`. `send` aborts the request before getting far enough to
+        // check if the file exists (hence, a 404 `NotFoundError` instead of
+        // `ENOENT`).
+        // https://github.com/pillarjs/send/blob/de073ed3237ade9ff71c61673a34474b30e5d45b/index.js#L582
+        if (metadata.error.status === 404) {
+          return reply.callNotFound()
         }
 
-        if (opts.preCompressed && !checkedEncodings.has(encoding)) {
-          checkedEncodings.add(encoding)
-          return pumpSendToReply(
-            request,
-            reply,
-            pathnameOrig,
-            rootPath,
-            rootPathOffset,
-            undefined,
-            checkedEncodings
-          )
-        }
-
-        return reply.callNotFound()
+        await reply.send(metadata.error)
+        break
       }
-
-      // The `send` library terminates the request with a 404 if the requested
-      // path contains a dotfile and `send` is initialized with `{dotfiles:
-      // 'ignore'}`. `send` aborts the request before getting far enough to
-      // check if the file exists (hence, a 404 `NotFoundError` instead of
-      // `ENOENT`).
-      // https://github.com/pillarjs/send/blob/de073ed3237ade9ff71c61673a34474b30e5d45b/index.js#L582
-      if (err.status === 404) {
-        return reply.callNotFound()
+      case 'file': {
+        reply.code(statusCode)
+        if (setHeaders !== undefined) {
+          setHeaders(reply.raw, metadata.path, metadata.stat)
+        }
+        reply.headers(headers)
+        if (encoding) {
+          reply.header('content-type', getContentType(pathname))
+          reply.header('content-encoding', encoding)
+        }
+        await reply.send(stream)
+        break
       }
-
-      reply.send(err)
-    })
-
-    // we cannot use pump, because send error
-    // handling is not compatible
-    stream.pipe(wrap)
+    }
   }
 
   function setUpHeadAndGet (routeOpts, route, file, rootPath) {
@@ -393,11 +377,11 @@ async function fastifyStatic (fastify, opts) {
     fastify.route(toSetUp)
   }
 
-  function serveFileHandler (req, reply) {
+  async function serveFileHandler (req, reply) {
     // TODO: remove the fallback branch when bump major
-    /* istanbul ignore next */
+    /* c8 ignore next */
     const routeConfig = req.routeOptions?.config || req.routeConfig
-    pumpSendToReply(req, reply, routeConfig.file, routeConfig.rootPath)
+    return pumpSendToReply(req, reply, routeConfig.file, routeConfig.rootPath)
   }
 }
 
@@ -488,8 +472,6 @@ function getContentType (path) {
 }
 
 function findIndexFile (pathname, root, indexFiles = ['index.html']) {
-  // TODO remove istanbul ignore
-  /* istanbul ignore else */
   if (Array.isArray(indexFiles)) {
     return indexFiles.find(filename => {
       const p = path.join(root, pathname, filename)
@@ -501,7 +483,7 @@ function findIndexFile (pathname, root, indexFiles = ['index.html']) {
       }
     })
   }
-  /* istanbul ignore next */
+  /* c8 ignore next */
   return false
 }
 
@@ -540,19 +522,16 @@ function getRedirectUrl (url) {
     const parsed = new URL(url, 'http://localhost.com/')
     const parsedPathname = parsed.pathname
     return parsedPathname + (parsedPathname[parsedPathname.length - 1] !== '/' ? '/' : '') + (parsed.search || '')
-  } catch {
+  } /* c8 ignore start */ catch {
     // the try-catch here is actually unreachable, but we keep it for safety and prevent DoS attack
-    /* istanbul ignore next */
     const err = new Error(`Invalid redirect URL: ${url}`)
-    /* istanbul ignore next */
     err.statusCode = 400
-    /* istanbul ignore next */
     throw err
-  }
+  } /* c8 ignore stop */
 }
 
 module.exports = fp(fastifyStatic, {
-  fastify: '4.x',
+  fastify: '5.x',
   name: '@fastify/static'
 })
 module.exports.default = fastifyStatic

package/lib/dirList.js

@@ -125,9 +125,9 @@ const dirList = {
         entries.dirs.forEach(entry => nameEntries.dirs.push(entry.name))
         entries.files.forEach(entry => nameEntries.files.push(entry.name))
 
-        reply.send(nameEntries)
+        await reply.send(nameEntries)
       } else {
-        reply.send(entries)
+        await reply.send(entries)
       }
       return
     }
@@ -135,7 +135,7 @@ const dirList = {
     const html = options.render(
       entries.dirs.map(entry => dirList.htmlInfo(entry, route, prefix, options)),
       entries.files.map(entry => dirList.htmlInfo(entry, route, prefix, options)))
-    reply.type('text/html').send(html)
+    await reply.type('text/html').send(html)
   },
 
   /**
@@ -149,7 +149,7 @@ const dirList = {
       route = path.normalize(path.join(route, '..'))
     }
     return {
-      href: path.join(prefix, route, entry.name).replace(/\\/gu, '/'),
+      href: encodeURI(path.join(prefix, route, entry.name).replace(/\\/gu, '/')),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/static",
-  "version": "7.0.3",
+  "version": "8.0.0-pre.fv5.1",
   "description": "Plugin for serving static files as fast as possible.",
   "main": "index.js",
   "type": "commonjs",
@@ -31,32 +31,31 @@
   },
   "homepage": "https://github.com/fastify/fastify-static",
   "dependencies": {
-    "@fastify/accept-negotiator": "^1.0.0",
-    "@fastify/send": "^2.0.0",
-    "content-disposition": "^0.5.3",
-    "fastify-plugin": "^4.0.0",
-    "fastq": "^1.17.0",
-    "glob": "^10.3.4"
+    "@fastify/accept-negotiator": "^2.0.0-pre.fv5.1",
+    "@fastify/send": "^3.1.0",
+    "content-disposition": "^0.5.4",
+    "fastify-plugin": "^5.0.0-pre.fv5.1",
+    "fastq": "^1.17.1",
+    "glob": "^10.3.10"
   },
   "devDependencies": {
-    "@fastify/compress": "^7.0.0",
-    "@fastify/pre-commit": "^2.0.2",
-    "@types/node": "^20.1.0",
-    "@typescript-eslint/eslint-plugin": "^7.1.0",
-    "@typescript-eslint/parser": "^7.1.0",
+    "@fastify/compress": "^8.0.0-pre.fv5.1",
+    "@fastify/pre-commit": "^2.1.0",
+    "@types/node": "^20.11.30",
+    "@typescript-eslint/eslint-plugin": "^7.3.1",
+    "@typescript-eslint/parser": "^7.3.1",
     "concat-stream": "^2.0.0",
-    "coveralls": "^3.0.4",
-    "eslint-plugin-typescript": "^0.14.0",
-    "fastify": "^4.0.0-rc.2",
-    "handlebars": "^4.7.6",
-    "pino": "^8.4.2",
-    "proxyquire": "^2.1.0",
-    "simple-get": "^4.0.0",
+    "coveralls": "^3.1.1",
+    "fastify": "^5.0.0-alpha.3",
+    "handlebars": "^4.7.8",
+    "pino": "^9.1.0",
+    "proxyquire": "^2.1.3",
+    "simple-get": "^4.0.1",
     "snazzy": "^9.0.0",
-    "standard": "^17.0.0",
-    "tap": "^16.0.0",
+    "standard": "^17.1.0",
+    "tap": "^18.7.1",
     "tsd": "^0.31.0",
-    "typescript": "^5.1.6"
+    "typescript": "^5.4.3"
   },
   "tsd": {
     "directory": "test/types"

package/test/dir-list.test.js

@@ -154,7 +154,35 @@ t.test('dir list, custom options', t => {
   }
 
   const route = '/public/'
-  const content = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const content = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+
+  helper.arrange(t, options, (url) => {
+    t.test(route, t => {
+      t.plan(3)
+      simple.concat({
+        method: 'GET',
+        url: url + route
+      }, (err, response, body) => {
+        t.error(err)
+        t.equal(response.statusCode, 200)
+        t.equal(body.toString(), JSON.stringify(content))
+      })
+    })
+  })
+})
+
+t.test('dir list, custom options with empty array index', t => {
+  t.plan(2)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: [],
+    list: true
+  }
+
+  const route = '/public/'
+  const content = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     t.test(route, t => {
@@ -205,7 +233,8 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
-  <li><a href="/public/a .md" target="_blank">a .md</a></li>
+  <li><a href="/public/100%25.txt" target="_blank">100%.txt</a></li>
+  <li><a href="/public/a%20.md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
   <li><a href="/public/index.css" target="_blank">index.css</a></li>
@@ -236,7 +265,8 @@ t.test('dir list html format', t => {
 </ul>
 <ul>
   <li><a href="/public/.example" target="_blank">.example</a></li>
-  <li><a href="/public/a .md" target="_blank">a .md</a></li>
+  <li><a href="/public/100%25.txt" target="_blank">100%.txt</a></li>
+  <li><a href="/public/a%20.md" target="_blank">a .md</a></li>
   <li><a href="/public/foo.html" target="_blank">foo.html</a></li>
   <li><a href="/public/foobar.html" target="_blank">foobar.html</a></li>
   <li><a href="/public/index.css" target="_blank">index.css</a></li>
@@ -469,7 +499,7 @@ t.test('dir list json format - extended info', t => {
           t.equal(response.statusCode, 200)
           const bodyObject = JSON.parse(body.toString())
           t.equal(bodyObject.dirs[0].name, 'empty')
-          t.equal(typeof bodyObject.dirs[0].stats.atime, 'string')
+          t.equal(typeof bodyObject.dirs[0].stats.atimeMs, 'number')
           t.equal(typeof bodyObject.dirs[0].extendedInfo.totalSize, 'number')
         })
       })
@@ -492,7 +522,7 @@ t.test('json format with url parameter format', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -539,7 +569,7 @@ t.test('json format with url parameter format and without render option', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -588,7 +618,7 @@ t.test('html format with url parameter format', t => {
     }
   }
   const route = '/public/'
-  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
+  const jsonContent = { dirs: ['deep', 'shallow'], files: ['.example', '100%.txt', 'a .md', 'foo.html', 'foobar.html', 'index.css', 'index.html'] }
 
   helper.arrange(t, options, (url) => {
     simple.concat({
@@ -843,7 +873,7 @@ t.test('dir list error', t => {
   const errorMessage = 'mocking send'
   dirList.send = async () => { throw new Error(errorMessage) }
 
-  const mock = t.mock('..', {
+  const mock = t.mockRequire('..', {
     '../lib/dirList.js': dirList
   })
 

package/test/static/100%.txt

@@ -0,0 +1 @@
+100%

package/test/static.test.js

@@ -681,7 +681,7 @@ t.test('register /static with constraints', (t) => {
   })
 })
 
-t.test('payload.filename is set', (t) => {
+t.test('payload.path is set', (t) => {
   t.plan(3)
 
   const pluginOptions = {
@@ -692,7 +692,7 @@ t.test('payload.filename is set', (t) => {
   let gotFilename
   fastify.register(fastifyStatic, pluginOptions)
   fastify.addHook('onSend', function (req, reply, payload, next) {
-    gotFilename = payload.filename
+    gotFilename = payload.path
     next()
   })
 
@@ -1361,13 +1361,13 @@ t.test('root not found warning', (t) => {
   const destination = concat((data) => {
     t.equal(JSON.parse(data).msg, `"root" path "${rootPath}" must exist`)
   })
-  const logger = pino(
+  const loggerInstance = pino(
     {
       level: 'warn'
     },
     destination
   )
-  const fastify = Fastify({ logger })
+  const fastify = Fastify({ loggerInstance })
   fastify.register(fastifyStatic, pluginOptions)
   fastify.listen({ port: 0 }, (err) => {
     t.error(err)
@@ -3963,6 +3963,33 @@ t.test(
   }
 )
 
+t.test(
+  'serves files with % in the filename',
+  async (t) => {
+    t.plan(2)
+
+    const txtContent = fs.readFileSync(path.join(__dirname, 'static', '100%.txt'), 'utf-8')
+
+    const pluginOptions = {
+      root: url.pathToFileURL(path.join(__dirname, '/static')),
+      wildcard: false
+    }
+
+    const fastify = Fastify()
+
+    fastify.register(fastifyStatic, pluginOptions)
+    const response = await fastify.inject({
+      method: 'GET',
+      url: '100%25.txt',
+      headers: {
+        'accept-encoding': '*, *'
+      }
+    })
+    t.equal(response.statusCode, 200)
+    t.same(response.body, txtContent)
+  }
+)
+
 t.test('content-length in head route should not return zero when using wildcard', t => {
   t.plan(6)