Do not serve files when path ends with / in windows (#224)

pillarjs · Jul 26, 2024 · 9774100 · 9774100
1 parent 672e5c3
commit 9774100
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/index.js b/index.js
@@ -605,12 +605,14 @@ SendStream.prototype.sendFile = function sendFile (path) {
 
   debug('stat "%s"', path)
   fs.stat(path, function onstat (err, stat) {
-    if (err && err.code === 'ENOENT' && !extname(path) && path[path.length - 1] !== sep) {
+    var pathEndsWithSep = path[path.length - 1] === sep
+    if (err && err.code === 'ENOENT' && !extname(path) && !pathEndsWithSep) {
       // not found, check extensions
       return next(err)
     }
     if (err) return self.onStatError(err)
     if (stat.isDirectory()) return self.redirect(path)
+    if (pathEndsWithSep) return self.error(404)
     self.emit('file', path, stat)
     self.send(path, stat)
   })

diff --git a/test/send.js b/test/send.js
@@ -1194,6 +1194,12 @@ describe('send(file, options)', function () {
         .get('/')
         .expect(200, /tobi/, done)
     })
+
+    it('should 404 if file path contains trailing slash (windows)', function (done) {
+      request(createServer({ root: fixtures, index: false }))
+        .get('/tobi.html/')
+        .expect(404, done)
+    })
   })
 
   describe('root', function () {