@fastify/static 9.0.0 → 9.1.1

package/.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/LICENSE

@@ -1,8 +1,6 @@
 MIT License
 
-Copyright (c) 2017-present The Fastify team
-
-The Fastify team members are listed at https://github.com/fastify/fastify#team.
+Copyright (c) 2017-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/index.js

@@ -122,7 +122,12 @@ async function fastifyStatic (fastify, opts) {
         method: ['HEAD', 'GET'],
         path: prefix + '*',
         handler (req, reply) {
-          pumpSendToReply(req, reply, '/' + req.params['*'], sendOptions.root)
+          const pathname = getPathnameForSend(req.raw.url, prefix)
+          if (!pathname) {
+            return reply.callNotFound()
+          }
+
+          pumpSendToReply(req, reply, pathname, sendOptions.root)
         }
       })
       if (opts.redirect === true && prefix !== opts.prefix) {
@@ -176,6 +181,29 @@ async function fastifyStatic (fastify, opts) {
 
   const allowedPath = opts.allowedPath
 
+  /**
+   * @param {import("fastify").FastifyReply} reply
+   * @param {string} pathname
+   * @return {Promise<boolean>}
+   */
+  async function sendDirectoryList (reply, pathname) {
+    const dir = dirList.path(opts.root, pathname)
+    if (!dir) {
+      return false
+    }
+
+    await dirList.send({
+      reply,
+      dir,
+      options: opts.list,
+      route: pathname,
+      prefix,
+      dotfiles: opts.dotfiles
+    }).catch((err) => reply.send(err))
+
+    return true
+  }
+
   /**
    * @param {import("fastify").FastifyRequest} request
    * @param {import("fastify").FastifyReply} reply
@@ -274,7 +302,7 @@ async function fastifyStatic (fastify, opts) {
               pathname + '/',
               rootPath,
               undefined,
-              undefined,
+              pumpOptions,
               checkedEncodings
             )
           }
@@ -289,15 +317,7 @@ async function fastifyStatic (fastify, opts) {
           (!options.index || !options.index.length) &&
           pathnameForSend[pathnameForSend.length - 1] === '/'
         ) {
-          if (opts.list) {
-            await dirList.send({
-              reply,
-              dir: dirList.path(opts.root, pathname),
-              options: opts.list,
-              route: pathname,
-              prefix,
-              dotfiles: opts.dotfiles
-            }).catch((err) => reply.send(err))
+          if (opts.list && await sendDirectoryList(reply, pathname)) {
             return
           }
         }
@@ -314,7 +334,7 @@ async function fastifyStatic (fastify, opts) {
                   pathname + '/',
                   rootPath,
                   undefined,
-                  undefined,
+                  pumpOptions,
                   checkedEncodings
                 )
               }
@@ -322,21 +342,21 @@ async function fastifyStatic (fastify, opts) {
           }
 
           // if file exists, send real file, otherwise send dir list if name match
-          if (opts.list && dirList.handle(pathname, opts.list)) {
-            await dirList.send({
-              reply,
-              dir: dirList.path(opts.root, pathname),
-              options: opts.list,
-              route: pathname,
-              prefix,
-              dotfiles: opts.dotfiles
-            }).catch((err) => reply.send(err))
+          if (opts.list && dirList.handle(pathname, opts.list) && await sendDirectoryList(reply, pathname)) {
             return
           }
 
           // root paths left to try?
           if (Array.isArray(rootPath) && rootPathOffset < (rootPath.length - 1)) {
-            return pumpSendToReply(request, reply, pathname, rootPath, rootPathOffset + 1)
+            return pumpSendToReply(
+              request,
+              reply,
+              pathname,
+              rootPath,
+              rootPathOffset + 1,
+              pumpOptions,
+              undefined
+            )
           }
 
           if (opts.preCompressed && !checkedEncodings.has(encoding)) {
@@ -347,7 +367,7 @@ async function fastifyStatic (fastify, opts) {
               pathnameOrig,
               rootPath,
               rootPathOffset,
-              undefined,
+              pumpOptions,
               checkedEncodings
             )
           }
@@ -548,6 +568,40 @@ function getEncodingHeader (headers, checked) {
   )
 }
 
+/**
+ * @param {string} url
+ * @param {string} prefix
+ * @returns {string|undefined}
+ */
+function getPathnameForSend (url, prefix) {
+  const questionMark = url.indexOf('?')
+  let pathname = questionMark === -1 ? url : url.slice(0, questionMark)
+
+  if (prefix !== '/') {
+    const routePrefix = prefix.endsWith('/')
+      ? prefix.slice(0, -1)
+      : prefix
+
+    if (!pathname.startsWith(routePrefix)) {
+      return
+    }
+
+    pathname = pathname.slice(routePrefix.length)
+  }
+
+  if (pathname === '') {
+    pathname = '/'
+  } else if (!pathname.startsWith('/')) {
+    pathname = '/' + pathname
+  }
+
+  try {
+    return decodeURI(pathname)
+  } catch {
+
+  }
+}
+
 /**
  * @param {string} url
  * @return {string}

package/lib/dirList.js

@@ -6,6 +6,16 @@ const fs = require('node:fs/promises')
 const fastq = require('fastq')
 const fastqConcurrency = Math.max(1, os.cpus().length - 1)
 
+function isPathInsideRoot (root, target) {
+  const relativePath = path.relative(root, target)
+
+  return relativePath === '' || (
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relativePath)
+  )
+}
+
 const dirList = {
   _getExtendedInfo: async function (dir, info) {
     const depth = dir.split(path.sep).length
@@ -146,10 +156,10 @@ const dirList = {
    */
   htmlInfo: function (entry, route, prefix, options) {
     if (options.names?.includes(path.basename(route))) {
-      route = path.normalize(path.join(route, '..'))
+      route = path.posix.normalize(path.posix.join(route, '..'))
     }
     return {
-      href: encodeURI(path.join(prefix, route, entry.name).replace(/\\/gu, '/')),
+      href: encodeURI(path.posix.join(prefix, route, entry.name)),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo
@@ -172,12 +182,16 @@ const dirList = {
    * get path from route and fs root paths, considering trailing slash
    * @param {string} root fs root path
    * @param {string} route request route
+   * @return {string|null}
    */
   path: function (root, route) {
-    const _route = route[route.length - 1] === '/'
-      ? route + 'none'
-      : route
-    return path.dirname(path.join(root, _route))
+    const relativeRoute = route[route.length - 1] === '/'
+      ? '.' + route + 'none'
+      : '.' + route
+    const resolvedRoot = path.resolve(root)
+    const dir = path.dirname(path.resolve(resolvedRoot, relativeRoute))
+
+    return isPathInsideRoot(resolvedRoot, dir) ? dir : null
   },
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/static",
-  "version": "9.0.0",
+  "version": "9.1.1",
   "description": "Plugin for serving static files as fast as possible.",
   "main": "index.js",
   "type": "commonjs",
@@ -67,14 +67,14 @@
   },
   "devDependencies": {
     "@fastify/compress": "^8.0.0",
-    "@types/node": "^24.0.13",
-    "borp": "^0.20.0",
-    "c8": "^10.1.3",
+    "@types/node": "^25.0.3",
+    "borp": "^1.0.0",
+    "c8": "^11.0.0",
     "concat-stream": "^2.0.0",
     "eslint": "^9.17.0",
     "fastify": "^5.1.0",
     "neostandard": "^0.12.0",
-    "pino": "^9.1.0",
+    "pino": "^10.0.0",
     "proxyquire": "^2.1.3",
     "tsd": "^0.33.0"
   },

package/test/dir-list.test.js

@@ -3,6 +3,7 @@
 /* eslint n/no-deprecated-api: "off" */
 
 const fs = require('node:fs')
+const http = require('node:http')
 const path = require('node:path')
 const { test } = require('node:test')
 const Fastify = require('fastify')
@@ -18,6 +19,31 @@ const helper = {
     await fastify.listen({ port: 0 })
     fastify.server.unref()
     await f('http://localhost:' + fastify.server.address().port)
+  },
+  rawRequest: async function (baseUrl, route) {
+    const url = new URL(baseUrl)
+
+    return await new Promise((resolve, reject) => {
+      const request = http.request({
+        hostname: url.hostname,
+        port: url.port,
+        path: route,
+        method: 'GET'
+      }, (response) => {
+        let body = ''
+        response.setEncoding('utf8')
+        response.on('data', chunk => { body += chunk })
+        response.on('end', () => {
+          resolve({
+            statusCode: response.statusCode,
+            body
+          })
+        })
+      })
+
+      request.on('error', reject)
+      request.end()
+    })
   }
 }
 
@@ -65,6 +91,16 @@ test('throws when `list.format` is html and `list render` is not a function', t
   t.assert.deepStrictEqual(err.message, 'The `list.render` option must be a function and is required with html format')
 })
 
+test('dir list path stays within the configured root', t => {
+  t.plan(3)
+
+  const root = path.join(__dirname, '/static')
+
+  t.assert.deepStrictEqual(dirList.path(root, '/'), root)
+  t.assert.deepStrictEqual(dirList.path(root, '/deep/path/'), path.join(root, 'deep/path'))
+  t.assert.deepStrictEqual(dirList.path(root, '/../'), null)
+})
+
 test('dir list wrong options', async t => {
   t.plan(3)
 
@@ -181,6 +217,52 @@ test('dir list, custom options with empty array index', async t => {
   })
 })
 
+test('dir list blocks path traversal when index is false', async t => {
+  t.plan(2)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: false,
+    list: true
+  }
+  const routes = ['/public/../', '/public/../static2/']
+
+  await helper.arrange(t, options, async (url) => {
+    for (const route of routes) {
+      await t.test(route, async t => {
+        t.plan(2)
+
+        const response = await helper.rawRequest(url, route)
+        t.assert.deepStrictEqual(response.statusCode, 403)
+        t.assert.match(response.body, /Forbidden/u)
+      })
+    }
+  })
+})
+
+test('dir list blocks path traversal when index is an empty array', async t => {
+  t.plan(1)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: [],
+    list: true
+  }
+  const route = '/public/../'
+
+  await helper.arrange(t, options, async (url) => {
+    await t.test(route, async t => {
+      t.plan(2)
+
+      const response = await helper.rawRequest(url, route)
+      t.assert.deepStrictEqual(response.statusCode, 403)
+      t.assert.match(response.body, /Forbidden/u)
+    })
+  })
+})
+
 test('dir list html format', async t => {
   t.plan(2)
 

package/test/static/shallow/no-link

@@ -0,0 +1 @@
+/none

package/test/static-symbolic-link/dir/symlink

@@ -0,0 +1 @@
+../origin

package/test/static.test.js

@@ -870,6 +870,83 @@ test('sendFile', async (t) => {
   })
 })
 
+test('sendFile with multiple roots', async (t) => {
+  t.plan(4)
+
+  const pluginOptions = {
+    root: [path.join(__dirname, '/static'), path.join(__dirname, '/static2')],
+    prefix: '/static'
+  }
+  const fastify = Fastify()
+  const maxAge = Math.round(Math.random() * 10) * 10000
+  fastify.register(fastifyStatic, pluginOptions)
+
+  t.after(() => fastify.close())
+
+  fastify.get('/foo', function (_req, rep) {
+    rep.sendFile('foo.html')
+  })
+
+  fastify.get('/foo-with-options', function (_req, rep) {
+    rep.sendFile('foo.html', { maxAge })
+  })
+
+  fastify.get('/bar', function (_req, rep) {
+    rep.sendFile('bar.html')
+  })
+
+  fastify.get('/bar-with-options', function (_req, rep) {
+    rep.sendFile('bar.html', { maxAge })
+  })
+
+  await fastify.listen({ port: 0 })
+  fastify.server.unref()
+
+  await t.test('reply.sendFile() first root', async (t) => {
+    t.plan(4 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/foo')
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), fooContent)
+    t.assert.deepStrictEqual(response.headers.get('cache-control'), 'public, max-age=0')
+    genericResponseChecks(t, response)
+  })
+
+  await t.test('reply.sendFile() first root with options', async (t) => {
+    t.plan(4 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/foo-with-options')
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), fooContent)
+    t.assert.deepStrictEqual(response.headers.get('cache-control'), `public, max-age=${maxAge / 1000}`)
+    genericResponseChecks(t, response)
+  })
+
+  await t.test('reply.sendFile() second root', async (t) => {
+    t.plan(4 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/bar')
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), barContent)
+    t.assert.deepStrictEqual(response.headers.get('cache-control'), 'public, max-age=0')
+    genericResponseChecks(t, response)
+  })
+
+  await t.test('reply.sendFile() second root with options', async (t) => {
+    t.plan(4 + GENERIC_RESPONSE_CHECK_COUNT)
+
+    const response = await fetch('http://localhost:' + fastify.server.address().port + '/bar-with-options')
+    t.assert.ok(response.ok)
+    t.assert.deepStrictEqual(response.status, 200)
+    t.assert.deepStrictEqual(await response.text(), barContent)
+    t.assert.deepStrictEqual(response.headers.get('cache-control'), `public, max-age=${maxAge / 1000}`)
+    genericResponseChecks(t, response)
+  })
+})
+
 test('sendFile disabled', async (t) => {
   t.plan(1)
 
@@ -1438,7 +1515,7 @@ test('register no prefix', async (t) => {
   })
 })
 
-test('with fastify-compress', async t => {
+test('with fastify-compress', { timeout: 60000 }, async t => {
   t.plan(2)
 
   const pluginOptions = {
@@ -1476,6 +1553,7 @@ test('with fastify-compress', async t => {
     genericResponseChecks(t, response)
   })
 })
+
 test('register /static/ with schemaHide true', async t => {
   t.plan(2)
 
@@ -1712,7 +1790,9 @@ test('register with wildcard false (trailing slash in the root)', async t => {
     wildcard: false
   }
   const fastify = Fastify({
-    ignoreTrailingSlash: true
+    routerOptions: {
+      ignoreTrailingSlash: true
+    }
   })
   fastify.register(fastifyStatic, pluginOptions)
 
@@ -3174,8 +3254,8 @@ test('should not redirect to protocol-relative locations', async (t) => {
     ['//^/..', '/', 301],
     ['//^/.', null, 404], // it is NOT recognized as a directory by pillarjs/send
     ['//:/..', '/', 301],
-    ['/\\\\a//google.com/%2e%2e%2f%2e%2e', '/a//google.com/%2e%2e%2f%2e%2e/', 301],
-    ['//a//youtube.com/%2e%2e%2f%2e%2e', '/a//youtube.com/%2e%2e%2f%2e%2e/', 301],
+    ['/\\\\a//google.com/%2e%2e%2f%2e%2e', null, 404],
+    ['//a//youtube.com/%2e%2e%2f%2e%2e', null, 404],
     ['/^', null, 404], // it is NOT recognized as a directory by pillarjs/send
     ['//google.com/%2e%2e', '/', 301],
     ['//users/%2e%2e', '/', 301],
@@ -3510,6 +3590,36 @@ test(
   }
 )
 
+test('does not serve static files with encoded path separators', async (t) => {
+  t.plan(4)
+
+  const fastify = Fastify()
+
+  t.after(() => fastify.close())
+
+  fastify.all('/deep/*', async (_request, reply) => {
+    reply.code(401).send('Unauthorized')
+  })
+
+  fastify.register(fastifyStatic, {
+    root: path.join(__dirname, '/static')
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/deep/path/for/test/purpose/foo.html'
+  })
+  t.assert.deepStrictEqual(response.statusCode, 401)
+  t.assert.deepStrictEqual(response.body, 'Unauthorized')
+
+  const encodedPathResponse = await fastify.inject({
+    method: 'GET',
+    url: '/deep%2Fpath/for/test/purpose/foo.html'
+  })
+  t.assert.deepStrictEqual(encodedPathResponse.statusCode, 404)
+  t.assert.deepStrictEqual(encodedPathResponse.json().message, 'Route GET:/deep%2Fpath/for/test/purpose/foo.html not found')
+})
+
 test('content-length in head route should not return zero when using wildcard', async t => {
   t.plan(5)
 

package/types/index.d.ts

@@ -1,7 +1,3 @@
-// Definitions by: Jannik <https://github.com/jannikkeye>
-//                 Leo <https://github.com/leomelzer>
-/// <reference types="node" />
-
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, RouteOptions } from 'fastify'
 import { Stats } from 'node:fs'
 

package/types/index.test-d.ts

@@ -8,7 +8,7 @@ import fastifyStatic, {
   fastifyStatic as fastifyStaticNamed
 } from '..'
 
-import fastifyStaticCjsImport = require('..')
+const fastifyStaticCjsImport = fastifyStaticStar
 const fastifyStaticCjs = require('..')
 
 const app: FastifyInstance = fastify()

package/.github/stale.yml

@@ -1,21 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 15
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - "discussion"
-  - "feature request"
-  - "bug"
-  - "help wanted"
-  - "plugin suggestion"
-  - "good first issue"
-# Label to use when marking an issue as stale
-staleLabel: stale
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false