@jnode/server 2.2.1 → 2.2.2

package/README.md

@@ -401,7 +401,9 @@ Serves a single file with support for HTTP Range requests, caching headers, and
 ### Handler: `FolderHandler(folder[, options])`
 
 - `folder` [\<string\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#string_type) Path to the folder to serve files from.
-- `options` [\<Object\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object) Same as [`FileHandler` options](#handler-filehandlerfile-options).
+- `options` [\<Object\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object)
+  - `allowHiddenFile` [\<boolean\>](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Data_structures#boolean_type) Allows access to hidden directories and files (whose names begin with `.`).
+  - Same as [`FileHandler` options](#handler-filehandlerfile-options).
 
 Serves files from a folder based on remaining path segments. Automatically resolves paths and prevents directory traversal attacks. Internally uses `FileHandler`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jnode/server",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "Simple web server package for Node.js.",
   "main": "src/index.js",
   "scripts": {

package/src/handlers.js

@@ -183,6 +183,7 @@ class FolderHandler {
         const file = path.resolve(this.folder, ...env.path.slice(env.pathPointer));
 
         // safety check
+        if (file.includes(path.sep + '.') && !this.options.allowHiddenFile) throw 404;
         const rel = path.relative(this.folder, file);
         if (rel.startsWith('..') || path.isAbsolute(rel)) throw 404;