search

expressjs / serve-static

Serve static files
MIT License
1.38k stars 227 forks source link

Disable symlinks #120

Open gregmartyn opened 5 years ago

gregmartyn commented 5 years ago

If I'm doing .use(express.static('/var/www/html')) and some attacker manages to ln -s /etc/passwd /var/www/html, then http://host/passwd will serve up /etc/passwd. Is there any way to tell serve-static not to follow symlinks, or to restrict them so that they're only followed to files within the directory being served?

I'm essentially asking for Apache's FollowSymLinks or nginx's disable_symlinks.

dougwilson commented 5 years ago

No, this is not a feature currently, but a pull request to add such a feature would definitely be welcome!

jayk commented 4 years ago

I submitted a pull request that provides this behavior via a new option called followsymlinks which defaults to true. If it's set to false, it will cause paths that contain symlinks to be forbidden.