@remix-run/static-middleware 0.4.10 → 0.4.11

package/dist/lib/static.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/lib/static.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAkC,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAInG;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAA;AAE1D;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACnF;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAElC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAA;IAE7C;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CA8EtF"}
+{"version":3,"file":"static.d.ts","sourceRoot":"","sources":["../../src/lib/static.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,EAAkC,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AASnG;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAA;AAE1D;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,mBAAmB,EAAE,cAAc,CAAC;IACnF;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;IAElC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,oBAAoB,CAAA;IAE7C;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAA;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CAwGtF"}

package/dist/lib/static.js

@@ -1,6 +1,7 @@
 import * as path from 'node:path';
 import * as fsp from 'node:fs/promises';
 import { openLazyFile } from '@remix-run/fs';
+import { detectMimeType } from '@remix-run/mime';
 import { createFileResponse as sendFile } from '@remix-run/response/file';
 import { generateDirectoryListing } from "./directory-listing.js";
 /**
@@ -36,21 +37,42 @@ export function staticFiles(root, options = {}) {
         if (filter && !filter(relativePath)) {
             return next();
         }
+        let rootRealPath;
+        try {
+            rootRealPath = await fsp.realpath(root);
+        }
+        catch {
+            return next();
+        }
         let targetPath = path.join(root, relativePath);
-        let filePath;
+        let containedTargetPath = await resolveContainedPath(rootRealPath, targetPath);
+        if (containedTargetPath == null) {
+            return next();
+        }
+        let file;
         try {
-            let stats = await fsp.stat(targetPath);
+            let stats = await fsp.stat(containedTargetPath);
             if (stats.isFile()) {
-                filePath = targetPath;
+                file = {
+                    realPath: containedTargetPath,
+                    requestedPath: targetPath,
+                };
             }
             else if (stats.isDirectory()) {
                 // Try each index file in turn
                 for (let indexFile of index) {
                     let indexPath = path.join(targetPath, indexFile);
+                    let containedIndexPath = await resolveContainedPath(rootRealPath, indexPath);
+                    if (containedIndexPath == null) {
+                        continue;
+                    }
                     try {
-                        let indexStats = await fsp.stat(indexPath);
+                        let indexStats = await fsp.stat(containedIndexPath);
                         if (indexStats.isFile()) {
-                            filePath = indexPath;
+                            file = {
+                                realPath: containedIndexPath,
+                                requestedPath: indexPath,
+                            };
                             break;
                         }
                     }
@@ -59,17 +81,20 @@ export function staticFiles(root, options = {}) {
                     }
                 }
                 // If no index file found and listFiles is enabled, show directory listing
-                if (!filePath && listFiles) {
-                    return generateDirectoryListing(targetPath, context.url.pathname);
+                if (!file && listFiles) {
+                    return generateDirectoryListing(containedTargetPath, context.url.pathname);
                 }
             }
         }
         catch {
             // Path doesn't exist or isn't accessible, fall through
         }
-        if (filePath) {
-            let fileName = path.relative(root, filePath);
-            let lazyFile = openLazyFile(filePath, { name: fileName });
+        if (file) {
+            let fileName = path.relative(root, file.requestedPath);
+            let lazyFile = openLazyFile(file.realPath, {
+                name: fileName,
+                type: detectMimeType(file.requestedPath) ?? '',
+            });
             let finalFileOptions = { ...fileOptions };
             // If acceptRanges is a function, evaluate it with the lazyFile
             // Otherwise, pass it directly to sendFile
@@ -84,3 +109,16 @@ export function staticFiles(root, options = {}) {
         return next();
     };
 }
+async function resolveContainedPath(rootRealPath, targetPath) {
+    try {
+        let realPath = await fsp.realpath(targetPath);
+        return isContainedPath(rootRealPath, realPath) ? realPath : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isContainedPath(rootPath, targetPath) {
+    let relativePath = path.relative(rootPath, targetPath);
+    return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remix-run/static-middleware",
-  "version": "0.4.10",
+  "version": "0.4.11",
   "description": "Middleware for serving static files from the filesystem",
   "author": "Michael Jackson <mjijackson@gmail.com>",
   "license": "MIT",
@@ -29,19 +29,19 @@
     "@types/node": "^24.6.0",
     "@typescript/native-preview": "7.0.0-dev.20251125.1",
     "@remix-run/assert": "0.2.1",
-    "@remix-run/fetch-router": "0.19.1",
-    "@remix-run/form-data-middleware": "0.3.1",
-    "@remix-run/method-override-middleware": "0.1.9",
+    "@remix-run/fetch-router": "0.19.2",
+    "@remix-run/form-data-middleware": "0.3.2",
     "@remix-run/mime": "0.4.1",
-    "@remix-run/response": "0.3.5",
-    "@remix-run/test": "0.4.1"
+    "@remix-run/response": "0.3.6",
+    "@remix-run/test": "0.4.2",
+    "@remix-run/method-override-middleware": "0.1.10"
   },
   "dependencies": {
-    "@remix-run/fs": "^0.4.4",
-    "@remix-run/html-template": "^0.3.1",
-    "@remix-run/fetch-router": "^0.19.1",
+    "@remix-run/fetch-router": "^0.19.2",
     "@remix-run/mime": "^0.4.1",
-    "@remix-run/response": "^0.3.5"
+    "@remix-run/fs": "^0.4.5",
+    "@remix-run/response": "^0.3.6",
+    "@remix-run/html-template": "^0.3.1"
   },
   "keywords": [
     "fetch",

package/src/lib/static.ts

@@ -2,10 +2,16 @@ import * as path from 'node:path'
 import * as fsp from 'node:fs/promises'
 import { openLazyFile } from '@remix-run/fs'
 import type { Middleware } from '@remix-run/fetch-router'
+import { detectMimeType } from '@remix-run/mime'
 import { createFileResponse as sendFile, type FileResponseOptions } from '@remix-run/response/file'
 
 import { generateDirectoryListing } from './directory-listing.ts'
 
+interface StaticFileMatch {
+  realPath: string
+  requestedPath: string
+}
+
 /**
  * Function that determines if HTTP Range requests should be supported for a given file.
  *
@@ -107,22 +113,45 @@ export function staticFiles(root: string, options: StaticFilesOptions = {}): Mid
       return next()
     }
 
+    let rootRealPath: string
+    try {
+      rootRealPath = await fsp.realpath(root)
+    } catch {
+      return next()
+    }
+
     let targetPath = path.join(root, relativePath)
-    let filePath: string | undefined
+    let containedTargetPath = await resolveContainedPath(rootRealPath, targetPath)
+    if (containedTargetPath == null) {
+      return next()
+    }
+
+    let file: StaticFileMatch | undefined
 
     try {
-      let stats = await fsp.stat(targetPath)
+      let stats = await fsp.stat(containedTargetPath)
 
       if (stats.isFile()) {
-        filePath = targetPath
+        file = {
+          realPath: containedTargetPath,
+          requestedPath: targetPath,
+        }
       } else if (stats.isDirectory()) {
         // Try each index file in turn
         for (let indexFile of index) {
           let indexPath = path.join(targetPath, indexFile)
+          let containedIndexPath = await resolveContainedPath(rootRealPath, indexPath)
+          if (containedIndexPath == null) {
+            continue
+          }
+
           try {
-            let indexStats = await fsp.stat(indexPath)
+            let indexStats = await fsp.stat(containedIndexPath)
             if (indexStats.isFile()) {
-              filePath = indexPath
+              file = {
+                realPath: containedIndexPath,
+                requestedPath: indexPath,
+              }
               break
             }
           } catch {
@@ -131,17 +160,20 @@ export function staticFiles(root: string, options: StaticFilesOptions = {}): Mid
         }
 
         // If no index file found and listFiles is enabled, show directory listing
-        if (!filePath && listFiles) {
-          return generateDirectoryListing(targetPath, context.url.pathname)
+        if (!file && listFiles) {
+          return generateDirectoryListing(containedTargetPath, context.url.pathname)
         }
       }
     } catch {
       // Path doesn't exist or isn't accessible, fall through
     }
 
-    if (filePath) {
-      let fileName = path.relative(root, filePath)
-      let lazyFile = openLazyFile(filePath, { name: fileName })
+    if (file) {
+      let fileName = path.relative(root, file.requestedPath)
+      let lazyFile = openLazyFile(file.realPath, {
+        name: fileName,
+        type: detectMimeType(file.requestedPath) ?? '',
+      })
 
       let finalFileOptions: FileResponseOptions = { ...fileOptions }
 
@@ -159,3 +191,20 @@ export function staticFiles(root: string, options: StaticFilesOptions = {}): Mid
     return next()
   }
 }
+
+async function resolveContainedPath(
+  rootRealPath: string,
+  targetPath: string,
+): Promise<string | null> {
+  try {
+    let realPath = await fsp.realpath(targetPath)
+    return isContainedPath(rootRealPath, realPath) ? realPath : null
+  } catch {
+    return null
+  }
+}
+
+function isContainedPath(rootPath: string, targetPath: string): boolean {
+  let relativePath = path.relative(rootPath, targetPath)
+  return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath))
+}