st 3.0.2 → 3.0.4

package/.github/workflows/test.yml

@@ -10,9 +10,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
       - name: Install Dependencies

package/README.md

@@ -129,7 +129,7 @@ const mount = st({
     },
 
     content: {
-      max: 1024*1024*64, // how much memory to use on caching contents
+      maxSize: 1024*1024*64, // how much memory to use on caching contents
       maxAge: 1000 * 60 * 10, // how long to cache contents for
                               // if `false` does not set cache control headers
       cacheControl: 'public, max-age=600' // to set an explicit cache-control
@@ -137,12 +137,12 @@ const mount = st({
     },
 
     index: { // irrelevant if not using index:true
-      max: 1024 * 8, // how many bytes of autoindex html to cache
+      maxSize: 1024 * 8, // how many bytes of autoindex html to cache
       maxAge: 1000 * 60 * 10, // how long to store it for
     },
 
     readdir: { // irrelevant if not using index:true
-      max: 1000, // how many dir entries to cache
+      maxSize: 1000, // how many dir entries to cache
       maxAge: 1000 * 60 * 10, // how long to cache them for
     }
   },

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "st",
-  "version": "3.0.2",
+  "version": "3.0.4",
   "description": "A module for serving static files.  Does etags, caching, etc.",
   "main": "st.js",
   "bin": "bin/server.js",
   "dependencies": {
-    "async-cache": "^1.1.0",
+    "lru-cache": "^11.1.0",
     "bl": "^6.1.0",
     "fd": "^0.0.3",
     "mime": "^3.0.0",

package/st.js

@@ -9,7 +9,7 @@ try {
 const zlib = require('zlib')
 const Neg = require('negotiator')
 const http = require('http')
-const AC = require('async-cache')
+const { LRUCache } = require('lru-cache')
 const FD = require('fd')
 const bl = require('bl')
 const { STATUS_CODES } = http
@@ -17,26 +17,31 @@ const { STATUS_CODES } = http
 const defaultCacheOptions = {
   fd: {
     max: 1000,
-    maxAge: 1000 * 60 * 60
+    maxAge: 1000 * 60 * 60,
+    ignoreFetchAbort: true
   },
   stat: {
     max: 5000,
-    maxAge: 1000 * 60
+    maxAge: 1000 * 60,
+    ignoreFetchAbort: true
   },
   content: {
-    max: 1024 * 1024 * 64,
-    length: (n) => n.length,
-    maxAge: 1000 * 60 * 10
+    maxSize: 1024 * 1024 * 64,
+    sizeCalculation: (n) => n.length,
+    maxAge: 1000 * 60 * 10,
+    ignoreFetchAbort: true
   },
   index: {
-    max: 1024 * 8,
-    length: (n) => n.length,
-    maxAge: 1000 * 60 * 10
+    maxSize: 1024 * 8,
+    sizeCalculation: (n) => n.length,
+    maxAge: 1000 * 60 * 10,
+    ignoreFetchAbort: true
   },
   readdir: {
-    max: 1000,
-    length: (n) => n.length,
-    maxAge: 1000 * 60 * 10
+    maxSize: 1000,
+    sizeCalculation: (n) => Object.keys(n).length,
+    maxAge: 1000 * 60 * 10,
+    ignoreFetchAbort: true
   }
 }
 
@@ -44,8 +49,8 @@ const defaultCacheOptions = {
 // everything is really big.  kind of a kludge, but easiest way
 // to get it done
 const none = {
-  max: 1,
-  length: () => Infinity
+  maxSize: 1,
+  sizeCalculation: () => Number.MAX_SAFE_INTEGER
 }
 
 const noCaching = {
@@ -56,6 +61,17 @@ const noCaching = {
   content: none
 }
 
+const noCache = (fetch) => {
+  return {
+    maxSize: 0,
+    fetch,
+    has: () => false,
+    get: () => undefined,
+    set: () => {},
+    dump: () => []
+  }
+}
+
 function st (opt) {
   let p, u
   if (typeof opt === 'string') {
@@ -124,11 +140,11 @@ class Mount {
     // cache basically everything
     const c = this.getCacheOptions(opt)
     this.cache = {
-      fd: AC(c.fd),
-      stat: AC(c.stat),
-      index: AC(c.index),
-      readdir: AC(c.readdir),
-      content: AC(c.content)
+      fd: c.fd.noCache ? noCache(c.fd.fetchMethod) : new LRUCache(c.fd),
+      stat: c.stat.noCache ? noCache(c.stat.fetchMethod) : new LRUCache(c.stat),
+      index: c.index.noCache ? noCache(c.index.fetchMethod) : new LRUCache(c.index),
+      readdir: c.readdir.noCache ? noCache(c.readdir.fetchMethod) : new LRUCache(c.readdir),
+      content: c.content.noCache ? noCache(c.content.fetchMethod) : new LRUCache(c.content)
     }
 
     this._cacheControl =
@@ -145,7 +161,7 @@ class Mount {
     let o = opt.cache
     const set = (key) => {
       return o[key] === false
-        ? Object.assign({}, none)
+        ? Object.assign({ noCache: true }, none)
         : Object.assign(Object.assign({}, d[key]), o[key])
     }
 
@@ -158,7 +174,7 @@ class Mount {
     const d = defaultCacheOptions
 
     // should really only ever set max and maxAge here.
-    // load and fd disposal is important to control.
+    // fetchMethod and fd disposal is important to control.
     const c = {
       fd: set('fd'),
       stat: set('stat'),
@@ -167,13 +183,14 @@ class Mount {
       content: set('content')
     }
 
-    c.fd.dispose = this.fdman.close.bind(this.fdman)
-    c.fd.load = this.fdman.open.bind(this.fdman)
+    c.fd.dispose = (fd, key) => this.fdman.close(key, fd)
+    c.fd.fetchMethod = (key) => new Promise((resolve, reject) => this.fdman.open(key, (err, fd) => err ? reject(err) : resolve(fd)))
+
+    c.stat.fetchMethod = (key) => new Promise((resolve, reject) => this._loadStat(key, (err, fd) => err ? reject(err) : resolve(fd)))
+    c.index.fetchMethod = (key) => new Promise((resolve, reject) => this._loadIndex(key, (err, fd) => err ? reject(err) : resolve(fd)))
+    c.readdir.fetchMethod = (key) => new Promise((resolve, reject) => this._loadReaddir(key, (err, fd) => err ? reject(err) : resolve(fd)))
+    c.content.fetchMethod = (key) => new Promise((resolve, reject) => this._loadContent(key, (err, fd) => err ? reject(err) : resolve(fd)))
 
-    c.stat.load = this._loadStat.bind(this)
-    c.index.load = this._loadIndex.bind(this)
-    c.readdir.load = this._loadReaddir.bind(this)
-    c.content.load = this._loadContent.bind(this)
     return c
   }
 
@@ -181,28 +198,28 @@ class Mount {
   getUriPath (u) {
     let p = new URL(u, 'http://base').pathname
 
+    // Percent-decode before checking for `..` segments. The URL parser only
+    // resolves dot-segments that appear literally in the pathname, so an
+    // encoded separator (e.g. `/..%2f..%2fsecret`) keeps the `..` hidden and
+    // sails past the traversal check below until it is decoded. Decoding first
+    // means the check, and `path.normalize` after it, see the real path.
+    try {
+      p = decodeURIComponent(p)
+    } catch (e) {
+      // not a valid url-encoded path, so we can't safely serve it
+      return false
+    }
+
     // Convert any backslashes to forward slashes (for consistency)
     p = p.replace(/\\/g, '/')
 
-    // Remove the redundant leading slash replacement - URL().pathname always starts with /
-    if ((/[/\\]\.\.([/\\]|$)/).test(p)) {
+    if ((/(^|\/)\.\.(\/|$)/).test(p)) {
       return 403
     }
 
     u = path.normalize(p).replace(/\\/g, '/')
-    if (u.indexOf(this.url) !== 0) {
-      return false
-    }
-
-    // URL constructor already decoded, but we might need additional decoding
-    // for edge cases. Only do it if it would actually change something.
-    try {
-      const decoded = decodeURIComponent(u)
-      if (decoded !== u) {
-        u = decoded
-      }
-    } catch (e) {
-    // if decodeURIComponent failed, we weren't given a valid URL to begin with.
+    const prefix = this.url.endsWith('/') ? this.url : this.url + '/'
+    if (this.url !== '/' && u !== this.url && u.indexOf(prefix) !== 0) {
       return false
     }
 
@@ -210,16 +227,28 @@ class Mount {
     if (u.charAt(0) !== '/') {
       u = '/' + u
     }
+    if ((/(^|\/)\.\.(\/|$)/).test(u)) {
+      return 403
+    }
 
     return u
   }
 
   // get a path from a url
   getPath (u) {
-    // trailing slash removal to fix Node.js v23 bug
-    // https://github.com/nodejs/node/pull/55527
-    // can be removed when this is resolved and released
-    return path.join(this.path, u.replace(/\/+$/, ''))
+    // Normalize paths by removing trailing slashes
+    // This ensures consistent paths for directory content rendering
+    while (u.length > 0 && u[u.length - 1] === '/') {
+      u = u.slice(0, -1)
+    }
+
+    const p = path.resolve(this.path, '.' + u)
+    const rel = path.relative(this.path, p)
+    if (rel === '..' || rel.indexOf('..' + path.sep) === 0 || path.isAbsolute(rel)) {
+      return 403
+    }
+
+    return p
   }
 
   // get a url from a path
@@ -265,82 +294,89 @@ class Mount {
     }
 
     const p = this.getPath(req.sturl)
+    if (p === 403) {
+      res.statusCode = 403
+      res.end(STATUS_CODES[res.statusCode])
+      return true
+    }
 
     // now we have a path.  check for the fd.
-    this.cache.fd.get(p, (er, fd) => {
-      // inability to open is some kind of error, probably 404
-      // if we're in passthrough, AND got a next function, we can
-      // fall through to that.  otherwise, we already returned true,
-      // send an error.
-      if (er) {
+    this.cache.fd.fetch(p).then(
+      (fd) => {
+        // we may be about to use this, so don't let it be closed by cache purge
+        this.fdman.checkout(p, fd)
+        // a safe end() function that can be called multiple times but
+        // only perform a single checkin
+        const end = this.fdman.checkinfn(p, fd)
+
+        this.cache.stat.fetch(fd + ':' + p).then(
+          (stat) => {
+            const isDirectory = stat.isDirectory()
+
+            if (isDirectory) {
+              end() // we won't need this fd for a directory in any case
+              if (next && this.opt.passthrough === true && this._index === false) {
+                // this is done before if-modified-since and if-non-match checks so
+                // cached modified and etag values won't return 304's if we've since
+                // switched to !index. See Issue #51.
+                return next()
+              }
+            }
+
+            let ims = req.headers['if-modified-since']
+            if (ims) {
+              ims = new Date(ims).getTime()
+            }
+            if (ims && ims >= stat.mtime.getTime()) {
+              res.statusCode = 304
+              res.end()
+              return end()
+            }
+
+            const etag = getEtag(stat)
+            if (req.headers['if-none-match'] === etag) {
+              res.statusCode = 304
+              res.end()
+              return end()
+            }
+
+            // only set headers once we're sure we'll be serving this request
+            if (!res.getHeader('cache-control') && this._cacheControl) {
+              res.setHeader('cache-control', this._cacheControl)
+            }
+            res.setHeader('last-modified', stat.mtime.toUTCString())
+            res.setHeader('etag', etag)
+
+            if (this.opt.cors) {
+              res.setHeader('Access-Control-Allow-Origin', '*')
+              res.setHeader('Access-Control-Allow-Headers',
+                'Origin, X-Requested-With, Content-Type, Accept, Range')
+            }
+
+            return isDirectory
+              ? this.index(p, req, res)
+              : this.file(p, fd, stat, etag, req, res, end)
+          },
+          (er) => {
+            if (next && this.opt.passthrough === true && this._index === false) {
+              return next()
+            }
+            end()
+            return this.error(er, res)
+          }
+        )
+      },
+      (er) => {
+        // inability to open is some kind of error, probably 404
+        // if we're in passthrough, AND got a next function, we can
+        // fall through to that.  otherwise, we already returned true,
+        // send an error.
         if (this.opt.passthrough === true && er.code === 'ENOENT' && next) {
           return next()
         }
         return this.error(er, res)
       }
-
-      // we may be about to use this, so don't let it be closed by cache purge
-      this.fdman.checkout(p, fd)
-      // a safe end() function that can be called multiple times but
-      // only perform a single checkin
-      const end = this.fdman.checkinfn(p, fd)
-
-      this.cache.stat.get(fd + ':' + p, (er, stat) => {
-        if (er) {
-          if (next && this.opt.passthrough === true && this._index === false) {
-            return next()
-          }
-          end()
-          return this.error(er, res)
-        }
-
-        const isDirectory = stat.isDirectory()
-
-        if (isDirectory) {
-          end() // we won't need this fd for a directory in any case
-          if (next && this.opt.passthrough === true && this._index === false) {
-            // this is done before if-modified-since and if-non-match checks so
-            // cached modified and etag values won't return 304's if we've since
-            // switched to !index. See Issue #51.
-            return next()
-          }
-        }
-
-        let ims = req.headers['if-modified-since']
-        if (ims) {
-          ims = new Date(ims).getTime()
-        }
-        if (ims && ims >= stat.mtime.getTime()) {
-          res.statusCode = 304
-          res.end()
-          return end()
-        }
-
-        const etag = getEtag(stat)
-        if (req.headers['if-none-match'] === etag) {
-          res.statusCode = 304
-          res.end()
-          return end()
-        }
-
-        // only set headers once we're sure we'll be serving this request
-        if (!res.getHeader('cache-control') && this._cacheControl) {
-          res.setHeader('cache-control', this._cacheControl)
-        }
-        res.setHeader('last-modified', stat.mtime.toUTCString())
-        res.setHeader('etag', etag)
-
-        if (this.opt.cors) {
-          res.setHeader('Access-Control-Allow-Origin', '*')
-          res.setHeader('Access-Control-Allow-Headers',
-            'Origin, X-Requested-With, Content-Type, Accept, Range')
-        }
-
-        return isDirectory
-          ? this.index(p, req, res)
-          : this.file(p, fd, stat, etag, req, res, end)
-      })
-    })
+    )
 
     return true
   }
@@ -385,16 +421,15 @@ class Mount {
       return
     }
 
-    this.cache.index.get(p, (er, html) => {
-      if (er) {
-        return this.error(er, res)
-      }
-
-      res.statusCode = 200
-      res.setHeader('content-type', 'text/html')
-      res.setHeader('content-length', html.length)
-      res.end(html)
-    })
+    this.cache.index.fetch(p).then(
+      (html) => {
+        res.statusCode = 200
+        res.setHeader('content-type', 'text/html')
+        res.setHeader('content-length', html.length)
+        res.end(html)
+      },
+      (er) => this.error(er, res)
+    )
   }
 
   file (p, fd, stat, etag, req, res, end) {
@@ -418,23 +453,19 @@ class Mount {
     const key = stat.size + ':' + etag
     const gz = this.opt.gzip !== false && getGz(p, req)
 
-    this.cache.content.get(key, (er, content) => {
-      if (er) {
-        return this.error(er, res)
-      }
-      res.statusCode = 200
-      if (this.opt.cachedHeader) {
-        res.setHeader('x-from-cache', 'true')
-      }
-      if (gz && content.gz) {
-        res.setHeader('content-encoding', 'gzip')
-        res.setHeader('content-length', content.gz.length)
-        res.end(content.gz)
-      } else {
-        res.setHeader('content-length', content.length)
-        res.end(content)
-      }
-    })
+    const content = this.cache.content.get(key)
+    res.statusCode = 200
+    if (this.opt.cachedHeader) {
+      res.setHeader('x-from-cache', 'true')
+    }
+    if (gz && content.gz) {
+      res.setHeader('content-encoding', 'gzip')
+      res.setHeader('content-length', content.gz.length)
+      res.end(content.gz)
+    } else {
+      res.setHeader('content-length', content.length)
+      res.end(content)
+    }
   }
 
   streamFile (p, fd, stat, etag, req, res, end) {
@@ -445,7 +476,7 @@ class Mount {
     // gzip only if not explicitly turned off or client doesn't accept it
     const gzOpt = this.opt.gzip !== false
     const gz = gzOpt && getGz(p, req)
-    const cachable = this.cache.content._cache.max > stat.size
+    const cachable = this.cache.content.maxSize > stat.size
     let gzstr
 
     // need a gzipped version for the cache, so do it regardless of what the client wants
@@ -530,57 +561,56 @@ class Mount {
       '<h1>Index of ' + t + '</h1>' +
       '<hr><pre><a href="../">../</a>\n'
 
-    this.cache.readdir.get(p, (er, data) => {
-      if (er) {
-        return cb(er)
-      }
+    this.cache.readdir.fetch(p).then(
+      (data) => {
+        let nameLen = 0
+        let sizeLen = 0
 
-      let nameLen = 0
-      let sizeLen = 0
+        Object.keys(data).map((f) => {
+          const d = data[f]
 
-      Object.keys(data).map((f) => {
-        const d = data[f]
+          let name = f
+            .replace(/"/g, '&quot;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/'/g, '&#39;')
 
-        let name = f
-          .replace(/"/g, '&quot;')
-          .replace(/</g, '&lt;')
-          .replace(/>/g, '&gt;')
-          .replace(/'/g, '&#39;')
-
-        if (d.size === '-') {
-          name += '/'
-        }
-        const showName = name.replace(/^(.{40}).{3,}$/, '$1..>')
-        const linkName = encodeURIComponent(name)
-          .replace(/%2e/ig, '.') // Encoded dots are dots
-          .replace(/%2f|%5c/ig, '/') // encoded slashes are /
-          .replace(/[/\\]/g, '/') // back slashes are slashes
-
-        nameLen = Math.max(nameLen, showName.length)
-        sizeLen = Math.max(sizeLen, ('' + d.size).length)
-        return ['<a href="' + linkName + '">' + showName + '</a>',
-          d.mtime, d.size, showName]
-      }).sort((a, b) => {
-        return a[2] === '-' && b[2] !== '-' // dirs first
-          ? -1
-          : a[2] !== '-' && b[2] === '-'
-            ? 1
-            : a[0].toLowerCase() < b[0].toLowerCase() // then alpha
-              ? -1
-              : a[0].toLowerCase() > b[0].toLowerCase()
-                ? 1
-                : 0
-      }).forEach((line) => {
-        const namePad = new Array(8 + nameLen - line[3].length).join(' ')
-        const sizePad = new Array(8 + sizeLen - ('' + line[2]).length).join(' ')
-        str += line[0] + namePad +
-              line[1].toISOString() +
-              sizePad + line[2] + '\n'
-      })
+          if (d.size === '-') {
+            name += '/'
+          }
+          const showName = name.replace(/^(.{40}).{3,}$/, '$1..>')
+          const linkName = encodeURIComponent(name)
+            .replace(/%2e/ig, '.') // Encoded dots are dots
+            .replace(/%2f|%5c/ig, '/') // encoded slashes are /
+            .replace(/[/\\]/g, '/') // back slashes are slashes
+
+          nameLen = Math.max(nameLen, showName.length)
+          sizeLen = Math.max(sizeLen, ('' + d.size).length)
+          return ['<a href="' + linkName + '">' + showName + '</a>',
+            d.mtime, d.size, showName]
+        }).sort((a, b) => {
+          return a[2] === '-' && b[2] !== '-' // dirs first
+            ? -1
+            : a[2] !== '-' && b[2] === '-'
+              ? 1
+              : a[0].toLowerCase() < b[0].toLowerCase() // then alpha
+                ? -1
+                : a[0].toLowerCase() > b[0].toLowerCase()
+                  ? 1
+                  : 0
+        }).forEach((line) => {
+          const namePad = new Array(8 + nameLen - line[3].length).join(' ')
+          const sizePad = new Array(8 + sizeLen - ('' + line[2]).length).join(' ')
+          str += line[0] + namePad +
+            line[1].toISOString() +
+            sizePad + line[2] + '\n'
+        })
 
-      str += '</pre><hr></body></html>'
-      cb(null, Buffer.from(str))
-    })
+        str += '</pre><hr></body></html>'
+        cb(null, Buffer.from(str))
+      },
+      (er) => cb(er)
+    )
   }
 
   _loadReaddir (p, cb) {
@@ -601,16 +631,16 @@ class Mount {
       data = {}
       files.forEach((file) => {
         const pf = path.join(p, file)
-        this.cache.stat.get(pf, (er, stat) => {
-          if (er) {
-            return cb(er)
-          }
-          if (stat.isDirectory()) {
-            stat.size = '-'
-          }
-          data[file] = stat
-          next()
-        })
+        this.cache.stat.fetch(pf).then(
+          (stat) => {
+            if (stat.isDirectory()) {
+              stat.size = '-'
+            }
+            data[file] = stat
+            next()
+          },
+          (er) => cb(er)
+        )
       })
     })
 
@@ -639,11 +669,11 @@ class Mount {
     }
   }
 
-  _loadContent () {
+  _loadContent (_, cb) {
     // this function should never be called.
     // we check if the thing is in the cache, and if not, stream it in
-    // manually.  this.cache.content.get() should not ever happen.
-    throw new Error('This should not ever happen')
+    // manually.  this.cache.content.fetch() should not ever happen.
+    return cb(new Error('This should never happen'))
   }
 }
 

package/test/dot-common.js

@@ -10,6 +10,7 @@ let server
 
 const opts = {
   dot: global.dot,
+  url: global.url,
   path: path.join(__dirname, 'fixtures', '.dotted-dir')
 }
 

package/test/encoded-traversal.js

@@ -0,0 +1,39 @@
+global.dot = true
+
+const path = require('path')
+const { test } = require('tap')
+const { req } = require('./dot-common')
+const st = require('../st.js')
+
+// A percent-encoded separator must not smuggle a `..` past the traversal
+// guard. `..%2f` (and `..%5c`) only decode to `../` after the path has been
+// checked, so the check has to run on the decoded path. `dot: true` is needed
+// to reach this: with the default `dot: false`, the decoded `..` is rejected
+// independently as a dot-url. `space in filename.txt` lives in the parent of
+// the served root, so a non-403 here would mean the response left the mount.
+
+test('encoded-slash parent traversal is forbidden', (t) => {
+  req('/..%2fspace%20in%20filename.txt', (er, res, body) => {
+    t.error(er)
+    t.equal(res.statusCode, 403)
+    t.end()
+  })
+})
+
+test('encoded-backslash parent traversal is forbidden', (t) => {
+  req('/..%5cspace%20in%20filename.txt', (er, res, body) => {
+    t.error(er)
+    t.equal(res.statusCode, 403)
+    t.end()
+  })
+})
+
+test('resolved paths cannot leave the root', (t) => {
+  const mount = st({
+    dot: true,
+    path: path.join(__dirname, 'fixtures', '.dotted-dir')
+  })._this
+
+  t.equal(mount.getPath('/../space in filename.txt'), 403)
+  t.end()
+})

package/test/mounted-encoded-traversal.js

@@ -0,0 +1,46 @@
+global.dot = true
+global.url = '/static'
+
+const { test } = require('tap')
+const { req } = require('./dot-common')
+
+// Non-root mounts need a segment-boundary check before stripping the mount
+// prefix. Otherwise `/static..%2fsecret` can pass validation as
+// `/static../secret`, then become `/../secret` after the `/static` prefix is
+// removed.
+
+test('mounted encoded-slash prefix traversal is not a match', (t) => {
+  req('/static..%2fspace%20in%20filename.txt', (er, res, body) => {
+    t.error(er)
+    t.equal(res.statusCode, 404)
+    t.notMatch(body, /space in filename/)
+    t.end()
+  })
+})
+
+test('mounted encoded-dot prefix traversal is not a match', (t) => {
+  req('/static%2e%2e%2fspace%20in%20filename.txt', (er, res, body) => {
+    t.error(er)
+    t.equal(res.statusCode, 404)
+    t.notMatch(body, /space in filename/)
+    t.end()
+  })
+})
+
+test('mounted encoded-backslash prefix traversal is not a match', (t) => {
+  req('/static..%5cspace%20in%20filename.txt', (er, res, body) => {
+    t.error(er)
+    t.equal(res.statusCode, 404)
+    t.notMatch(body, /space in filename/)
+    t.end()
+  })
+})
+
+test('mounted encoded traversal inside the mount is forbidden', (t) => {
+  req('/static/..%2fspace%20in%20filename.txt', (er, res, body) => {
+    t.error(er)
+    t.equal(res.statusCode, 403)
+    t.notMatch(body, /space in filename/)
+    t.end()
+  })
+})

package/test/no-cache.js

@@ -10,10 +10,10 @@ const { test } = require('tap')
 // additional tests to ensure that it's actually not caching.
 
 test('all caches should be empty', (t) => {
-  t.same(mount._this.cache.fd._cache.dump(), [])
-  t.same(mount._this.cache.stat._cache.dump(), [])
-  t.same(mount._this.cache.index._cache.dump(), [])
-  t.same(mount._this.cache.readdir._cache.dump(), [])
-  t.same(mount._this.cache.content._cache.dump(), [])
+  t.same(mount._this.cache.fd.dump(), [])
+  t.same(mount._this.cache.stat.dump(), [])
+  t.same(mount._this.cache.index.dump(), [])
+  t.same(mount._this.cache.readdir.dump(), [])
+  t.same(mount._this.cache.content.dump(), [])
   t.end()
 })