Comments (4)
If this is critical, please email me rather than posting on a public web site that everyone can read to attack any web site now. To proceed, please provide me the version of Node.js you are using, the version of this library, an example app that has this issue and the request to make to it. Feel free to provide these details by email (my email in in my GitHub profile).
from serve-static.
So after discussing over email and some code/stack trace sharing, it seems like rather than outside content sharing, this may have been confusion over why this module is causing a Error: Forbidden
. I believe @nallown was thinking it was caused by actually accessing the flies outside the root and getting a file system permission error. Rather, from the gathered stack traces, it was this module detecting that the URL would have resulted in a file access outside the root and just issued a 403 Forbidden response instead of attempting any outside access.
@nallown please chime in if this summary doesn't sound right :)
from serve-static.
Sounds right to me, exactly as mentioned.
Thanks for the support @dougwilson :)
from serve-static.
Alright, this is finally implemented! By default this will just next()
out of the middleware if the access is to outside the root. This is configurable with the new fallthough
option.
from serve-static.
Related Issues (20)
- how to prevent a file from being served HOT 2
- Add option to remove trailing slashes, as opposed to adding them HOT 9
- Support gzip static serving HOT 8
- Please add types for typescript HOT 1
- FR: Ability to always call next() HOT 8
- Extensions vs Directory HOT 1
- feature request: enable mapping url to a different file via a callback HOT 1
- Question: Is it possible to access the origin from setHeaders()? HOT 4
- Issue with Example Code HOT 4
- Make 'immutable' cache-control value HTTP/3 QPACK compatible HOT 1
- Use seconds instead of milliseconds for maxAge HOT 2
- 404 returned insted of 403 when uisng the dotfiles with "deny option" HOT 8
- setHeaders: need to access req.query HOT 2
- Corrupted file served if file is changed during serving. HOT 4
- Omitted `Content-Type` header when passing index file HOT 2
- Angular 13 SSR serve is failing with error - TypeError: Right-hand side of 'instanceof' is not an object HOT 5
- How to disable range requests in Next.js ? HOT 1
- Cannot use namespace 'HttpError' as a type HOT 3
- When the index is set to false, requests ending with / are being served with the content type header set to application/octet-stream instead of actual file's content type HOT 5
- error TS2688: Cannot find type definition file for 'mime'. HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from serve-static.