@fastify/static 9.1.0 → 9.1.1

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/index.js

@@ -122,7 +122,12 @@ async function fastifyStatic (fastify, opts) {
         method: ['HEAD', 'GET'],
         path: prefix + '*',
         handler (req, reply) {
-          pumpSendToReply(req, reply, '/' + req.params['*'], sendOptions.root)
+          const pathname = getPathnameForSend(req.raw.url, prefix)
+          if (!pathname) {
+            return reply.callNotFound()
+          }
+
+          pumpSendToReply(req, reply, pathname, sendOptions.root)
         }
       })
       if (opts.redirect === true && prefix !== opts.prefix) {
@@ -176,6 +181,29 @@ async function fastifyStatic (fastify, opts) {
 
   const allowedPath = opts.allowedPath
 
+  /**
+   * @param {import("fastify").FastifyReply} reply
+   * @param {string} pathname
+   * @return {Promise<boolean>}
+   */
+  async function sendDirectoryList (reply, pathname) {
+    const dir = dirList.path(opts.root, pathname)
+    if (!dir) {
+      return false
+    }
+
+    await dirList.send({
+      reply,
+      dir,
+      options: opts.list,
+      route: pathname,
+      prefix,
+      dotfiles: opts.dotfiles
+    }).catch((err) => reply.send(err))
+
+    return true
+  }
+
   /**
    * @param {import("fastify").FastifyRequest} request
    * @param {import("fastify").FastifyReply} reply
@@ -289,15 +317,7 @@ async function fastifyStatic (fastify, opts) {
           (!options.index || !options.index.length) &&
           pathnameForSend[pathnameForSend.length - 1] === '/'
         ) {
-          if (opts.list) {
-            await dirList.send({
-              reply,
-              dir: dirList.path(opts.root, pathname),
-              options: opts.list,
-              route: pathname,
-              prefix,
-              dotfiles: opts.dotfiles
-            }).catch((err) => reply.send(err))
+          if (opts.list && await sendDirectoryList(reply, pathname)) {
             return
           }
         }
@@ -322,15 +342,7 @@ async function fastifyStatic (fastify, opts) {
           }
 
           // if file exists, send real file, otherwise send dir list if name match
-          if (opts.list && dirList.handle(pathname, opts.list)) {
-            await dirList.send({
-              reply,
-              dir: dirList.path(opts.root, pathname),
-              options: opts.list,
-              route: pathname,
-              prefix,
-              dotfiles: opts.dotfiles
-            }).catch((err) => reply.send(err))
+          if (opts.list && dirList.handle(pathname, opts.list) && await sendDirectoryList(reply, pathname)) {
             return
           }
 
@@ -556,6 +568,40 @@ function getEncodingHeader (headers, checked) {
   )
 }
 
+/**
+ * @param {string} url
+ * @param {string} prefix
+ * @returns {string|undefined}
+ */
+function getPathnameForSend (url, prefix) {
+  const questionMark = url.indexOf('?')
+  let pathname = questionMark === -1 ? url : url.slice(0, questionMark)
+
+  if (prefix !== '/') {
+    const routePrefix = prefix.endsWith('/')
+      ? prefix.slice(0, -1)
+      : prefix
+
+    if (!pathname.startsWith(routePrefix)) {
+      return
+    }
+
+    pathname = pathname.slice(routePrefix.length)
+  }
+
+  if (pathname === '') {
+    pathname = '/'
+  } else if (!pathname.startsWith('/')) {
+    pathname = '/' + pathname
+  }
+
+  try {
+    return decodeURI(pathname)
+  } catch {
+
+  }
+}
+
 /**
  * @param {string} url
  * @return {string}

package/lib/dirList.js

@@ -6,6 +6,16 @@ const fs = require('node:fs/promises')
 const fastq = require('fastq')
 const fastqConcurrency = Math.max(1, os.cpus().length - 1)
 
+function isPathInsideRoot (root, target) {
+  const relativePath = path.relative(root, target)
+
+  return relativePath === '' || (
+    relativePath !== '..' &&
+    !relativePath.startsWith(`..${path.sep}`) &&
+    !path.isAbsolute(relativePath)
+  )
+}
+
 const dirList = {
   _getExtendedInfo: async function (dir, info) {
     const depth = dir.split(path.sep).length
@@ -146,10 +156,10 @@ const dirList = {
    */
   htmlInfo: function (entry, route, prefix, options) {
     if (options.names?.includes(path.basename(route))) {
-      route = path.normalize(path.join(route, '..'))
+      route = path.posix.normalize(path.posix.join(route, '..'))
     }
     return {
-      href: encodeURI(path.join(prefix, route, entry.name).replace(/\\/gu, '/')),
+      href: encodeURI(path.posix.join(prefix, route, entry.name)),
       name: entry.name,
       stats: entry.stats,
       extendedInfo: entry.extendedInfo
@@ -172,12 +182,16 @@ const dirList = {
    * get path from route and fs root paths, considering trailing slash
    * @param {string} root fs root path
    * @param {string} route request route
+   * @return {string|null}
    */
   path: function (root, route) {
-    const _route = route[route.length - 1] === '/'
-      ? route + 'none'
-      : route
-    return path.dirname(path.join(root, _route))
+    const relativeRoute = route[route.length - 1] === '/'
+      ? '.' + route + 'none'
+      : '.' + route
+    const resolvedRoot = path.resolve(root)
+    const dir = path.dirname(path.resolve(resolvedRoot, relativeRoute))
+
+    return isPathInsideRoot(resolvedRoot, dir) ? dir : null
   },
 
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/static",
-  "version": "9.1.0",
+  "version": "9.1.1",
   "description": "Plugin for serving static files as fast as possible.",
   "main": "index.js",
   "type": "commonjs",

package/test/dir-list.test.js

@@ -3,6 +3,7 @@
 /* eslint n/no-deprecated-api: "off" */
 
 const fs = require('node:fs')
+const http = require('node:http')
 const path = require('node:path')
 const { test } = require('node:test')
 const Fastify = require('fastify')
@@ -18,6 +19,31 @@ const helper = {
     await fastify.listen({ port: 0 })
     fastify.server.unref()
     await f('http://localhost:' + fastify.server.address().port)
+  },
+  rawRequest: async function (baseUrl, route) {
+    const url = new URL(baseUrl)
+
+    return await new Promise((resolve, reject) => {
+      const request = http.request({
+        hostname: url.hostname,
+        port: url.port,
+        path: route,
+        method: 'GET'
+      }, (response) => {
+        let body = ''
+        response.setEncoding('utf8')
+        response.on('data', chunk => { body += chunk })
+        response.on('end', () => {
+          resolve({
+            statusCode: response.statusCode,
+            body
+          })
+        })
+      })
+
+      request.on('error', reject)
+      request.end()
+    })
   }
 }
 
@@ -65,6 +91,16 @@ test('throws when `list.format` is html and `list render` is not a function', t
   t.assert.deepStrictEqual(err.message, 'The `list.render` option must be a function and is required with html format')
 })
 
+test('dir list path stays within the configured root', t => {
+  t.plan(3)
+
+  const root = path.join(__dirname, '/static')
+
+  t.assert.deepStrictEqual(dirList.path(root, '/'), root)
+  t.assert.deepStrictEqual(dirList.path(root, '/deep/path/'), path.join(root, 'deep/path'))
+  t.assert.deepStrictEqual(dirList.path(root, '/../'), null)
+})
+
 test('dir list wrong options', async t => {
   t.plan(3)
 
@@ -181,6 +217,52 @@ test('dir list, custom options with empty array index', async t => {
   })
 })
 
+test('dir list blocks path traversal when index is false', async t => {
+  t.plan(2)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: false,
+    list: true
+  }
+  const routes = ['/public/../', '/public/../static2/']
+
+  await helper.arrange(t, options, async (url) => {
+    for (const route of routes) {
+      await t.test(route, async t => {
+        t.plan(2)
+
+        const response = await helper.rawRequest(url, route)
+        t.assert.deepStrictEqual(response.statusCode, 403)
+        t.assert.match(response.body, /Forbidden/u)
+      })
+    }
+  })
+})
+
+test('dir list blocks path traversal when index is an empty array', async t => {
+  t.plan(1)
+
+  const options = {
+    root: path.join(__dirname, '/static'),
+    prefix: '/public',
+    index: [],
+    list: true
+  }
+  const route = '/public/../'
+
+  await helper.arrange(t, options, async (url) => {
+    await t.test(route, async t => {
+      t.plan(2)
+
+      const response = await helper.rawRequest(url, route)
+      t.assert.deepStrictEqual(response.statusCode, 403)
+      t.assert.match(response.body, /Forbidden/u)
+    })
+  })
+})
+
 test('dir list html format', async t => {
   t.plan(2)
 

package/test/static/shallow/no-link

@@ -0,0 +1 @@
+/none

package/test/static-symbolic-link/dir/symlink

@@ -0,0 +1 @@
+../origin

package/test/static.test.js

@@ -3254,8 +3254,8 @@ test('should not redirect to protocol-relative locations', async (t) => {
     ['//^/..', '/', 301],
     ['//^/.', null, 404], // it is NOT recognized as a directory by pillarjs/send
     ['//:/..', '/', 301],
-    ['/\\\\a//google.com/%2e%2e%2f%2e%2e', '/a//google.com/%2e%2e%2f%2e%2e/', 301],
-    ['//a//youtube.com/%2e%2e%2f%2e%2e', '/a//youtube.com/%2e%2e%2f%2e%2e/', 301],
+    ['/\\\\a//google.com/%2e%2e%2f%2e%2e', null, 404],
+    ['//a//youtube.com/%2e%2e%2f%2e%2e', null, 404],
     ['/^', null, 404], // it is NOT recognized as a directory by pillarjs/send
     ['//google.com/%2e%2e', '/', 301],
     ['//users/%2e%2e', '/', 301],
@@ -3590,6 +3590,36 @@ test(
   }
 )
 
+test('does not serve static files with encoded path separators', async (t) => {
+  t.plan(4)
+
+  const fastify = Fastify()
+
+  t.after(() => fastify.close())
+
+  fastify.all('/deep/*', async (_request, reply) => {
+    reply.code(401).send('Unauthorized')
+  })
+
+  fastify.register(fastifyStatic, {
+    root: path.join(__dirname, '/static')
+  })
+
+  const response = await fastify.inject({
+    method: 'GET',
+    url: '/deep/path/for/test/purpose/foo.html'
+  })
+  t.assert.deepStrictEqual(response.statusCode, 401)
+  t.assert.deepStrictEqual(response.body, 'Unauthorized')
+
+  const encodedPathResponse = await fastify.inject({
+    method: 'GET',
+    url: '/deep%2Fpath/for/test/purpose/foo.html'
+  })
+  t.assert.deepStrictEqual(encodedPathResponse.statusCode, 404)
+  t.assert.deepStrictEqual(encodedPathResponse.json().message, 'Route GET:/deep%2Fpath/for/test/purpose/foo.html not found')
+})
+
 test('content-length in head route should not return zero when using wildcard', async t => {
   t.plan(5)