Change access to files outside root to 404 instead of 403? about serve-static

[dougwilson]

If this is critical, please email me rather than posting on a public web site that everyone can read to attack any web site now. To proceed, please provide me the version of Node.js you are using, the version of this library, an example app that has this issue and the request to make to it. Feel free to provide these details by email (my email in in my GitHub profile).

[dougwilson]

So after discussing over email and some code/stack trace sharing, it seems like rather than outside content sharing, this may have been confusion over why this module is causing a Error: Forbidden. I believe @nallown was thinking it was caused by actually accessing the flies outside the root and getting a file system permission error. Rather, from the gathered stack traces, it was this module detecting that the URL would have resulted in a file access outside the root and just issued a 403 Forbidden response instead of attempting any outside access.

@nallown please chime in if this summary doesn't sound right :)

[nallown]

Sounds right to me, exactly as mentioned.
Thanks for the support @dougwilson :)

[dougwilson]

Alright, this is finally implemented! By default this will just next() out of the middleware if the access is to outside the root. This is configurable with the new fallthough option.