use URL for options.root

runtime-tests/bun/index.test.tsx

@@ -13,7 +13,6 @@ import { Hono } from '../../src/index'
 import { jsx } from '../../src/jsx'
 import { basicAuth } from '../../src/middleware/basic-auth'
 import { jwt } from '../../src/middleware/jwt'
-import { HonoRequest } from '../../src/request'
 
 // Test just only minimal patterns.
 // Because others are tested well in Cloudflare Workers environment already.
@@ -109,10 +108,7 @@ describe('Serve Static Middleware', () => {
     })
   )
 
-  app.all(
-    '/static-absolute-root/*',
-    serveStatic({ root: path.dirname(__filename), allowAbsoluteRoot: true })
-  )
+  app.all('/static-absolute-root/*', serveStatic({ root: path.dirname(__filename) }))
 
   beforeEach(() => onNotFound.mockClear())
 

runtime-tests/deno/middleware.test.tsx

@@ -95,10 +95,7 @@ Deno.test('Serve Static middleware', async () => {
     })
   )
 
-  app.get(
-    '/static-absolute-root/*',
-    serveStatic({ root: dirname(fromFileUrl(import.meta.url)), allowAbsoluteRoot: true })
-  )
+  app.get('/static-absolute-root/*', serveStatic({ root: dirname(fromFileUrl(import.meta.url)) }))
 
   app.get(
     '/static/*',

src/middleware/serve-static/index.test.ts

@@ -27,6 +27,17 @@ describe('Serve Static Middleware', () => {
 
   app.get('/static/*', serveStatic)
 
+  const serveStaticAbsoluteRoot = baseServeStatic({
+    getContent,
+    pathResolve: (path) => {
+      return path
+    },
+    root: '/home/hono/../foo',
+    allowAbsoluteRoot: true,
+  })
+
+  app.get('/static-absolute/*', serveStaticAbsoluteRoot)
+
   beforeEach(() => {
     getContent.mockClear()
   })
@@ -226,4 +237,10 @@ describe('Serve Static Middleware', () => {
     expect(res.status).toBe(200)
     expect(res.body).toBe(body)
   })
+
+  it('Should traverse directories with absolute root path', async () => {
+    const res = await app.request('/static-absolute/bar/hello.html')
+    expect(res.status).toBe(200)
+    expect(await res.text()).toBe('Hello in /home/foo/static-absolute/bar/hello.html')
+  })
 })

src/middleware/serve-static/index.ts

@@ -12,7 +12,6 @@ import { getMimeType } from '../../utils/mime'
 export type ServeStaticOptions<E extends Env = Env> = {
   root?: string
   path?: string
-  allowAbsoluteRoot?: boolean
   precompressed?: boolean
   mimes?: Record<string, string>
   rewriteRequestPath?: (path: string) => string
@@ -40,6 +39,16 @@ export const serveStatic = <E extends Env = Env>(
     isDir?: (path: string) => boolean | undefined | Promise<boolean | undefined>
   }
 ): MiddlewareHandler => {
+  let isAbsoluteRoot = false
+  let root: string
+
+  if (options.root) {
+    if (options.root.startsWith('/')) {
+      isAbsoluteRoot = true
+    }
+    root = new URL(`file://${options.root}`).pathname
+  }
+
   return async (c, next) => {
     // Do nothing if Response is already set
     if (c.finalized) {
@@ -49,16 +58,12 @@ export const serveStatic = <E extends Env = Env>(
 
     let filename = options.path ?? decodeURI(c.req.path)
     filename = options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename
-    const root = options.root
-
-    const allowAbsoluteRoot = options.allowAbsoluteRoot ?? false
 
     // If it was Directory, force `/` on the end.
     if (!filename.endsWith('/') && options.isDir) {
       const path = getFilePathWithoutDefaultDocument({
         filename,
         root,
-        allowAbsoluteRoot,
       })
       if (path && (await options.isDir(path))) {
         filename += '/'
@@ -68,14 +73,17 @@ export const serveStatic = <E extends Env = Env>(
     let path = getFilePath({
       filename,
       root,
-      allowAbsoluteRoot,
       defaultDocument: DEFAULT_DOCUMENT,
     })
 
     if (!path) {
       return await next()
     }
 
+    if (isAbsoluteRoot) {
+      path = '/' + path
+    }
+
     const getContent = options.getContent
     const pathResolve = options.pathResolve ?? defaultPathResolve
     path = pathResolve(path)

src/utils/filepath.test.ts

@@ -60,38 +60,6 @@ describe('getFilePath', () => {
     expect(getFilePath({ filename: 'filename.suffix_index' })).toBe('filename.suffix_index')
     expect(getFilePath({ filename: 'filename.suffix-index' })).toBe('filename.suffix-index')
   })
-
-  it('Should return file path correctly with allowAbsoluteRoot', async () => {
-    const allowAbsoluteRoot = true
-    expect(getFilePath({ filename: 'foo.txt', allowAbsoluteRoot })).toBe('/foo.txt')
-    expect(getFilePath({ filename: 'foo.txt', root: '/p', allowAbsoluteRoot })).toBe('/p/foo.txt')
-    expect(getFilePath({ filename: 'foo', root: '/p', allowAbsoluteRoot })).toBe(
-      '/p/foo/index.html'
-    )
-    expect(getFilePath({ filename: 'foo.txt', root: '/p/../p2', allowAbsoluteRoot })).toBe(
-      '/p2/foo.txt'
-    )
-    expect(getFilePath({ filename: 'foo', root: '/p/bar', allowAbsoluteRoot })).toBe(
-      '/p/bar/foo/index.html'
-    )
-    expect(
-      getFilePath({ filename: 'foo.txt', root: slashToBackslash('/p'), allowAbsoluteRoot })
-    ).toBe('/p/foo.txt')
-    expect(
-      getFilePath({ filename: 'foo.txt', root: slashToBackslash('/p/../p2'), allowAbsoluteRoot })
-    ).toBe('/p2/foo.txt')
-    expect(
-      getFilePath({ filename: 'foo.txt', root: slashToBackslash('/p/.../p2'), allowAbsoluteRoot })
-    ).toBe('/p/.../p2/foo.txt')
-
-    expect(
-      getFilePathWithoutDefaultDocument({
-        filename: '/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd',
-        root: '/p/p2',
-        allowAbsoluteRoot: true,
-      })
-    ).toBe('/p/p2/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd') // /etc/passwd
-  })
 })
 
 function slashToBackslash(filename: string) {

src/utils/filepath.ts

@@ -7,7 +7,6 @@ type FilePathOptions = {
   filename: string
   root?: string
   defaultDocument?: string
-  allowAbsoluteRoot?: boolean
 }
 
 export const getFilePath = (options: FilePathOptions): string | undefined => {
@@ -24,31 +23,12 @@ export const getFilePath = (options: FilePathOptions): string | undefined => {
 
   const path = getFilePathWithoutDefaultDocument({
     root: options.root,
-    allowAbsoluteRoot: options.allowAbsoluteRoot,
     filename,
   })
 
   return path
 }
 
-const normalizeFilePath = (filePath: string) => {
-  const parts = filePath.split(/[\/\\]/)
-
-  const result = []
-
-  for (const part of parts) {
-    if (part === '' || part === '.') {
-      continue
-    } else if (part === '..') {
-      result.pop()
-    } else {
-      result.push(part)
-    }
-  }
-
-  return '/' + (result.length === 1 ? result[0] : result.join('/'))
-}
-
 export const getFilePathWithoutDefaultDocument = (
   options: Omit<FilePathOptions, 'defaultDocument'>
 ): string | undefined => {
@@ -62,9 +42,6 @@ export const getFilePathWithoutDefaultDocument = (
   // /foo.html => foo.html
   filename = filename.replace(/^\.?[\/\\]/, '')
 
-  // assets\foo => assets/foo
-  root = root.replace(/\\/, '/')
-
   // foo\bar.txt => foo/bar.txt
   filename = filename.replace(/\\/, '/')
 
@@ -73,15 +50,7 @@ export const getFilePathWithoutDefaultDocument = (
 
   // ./assets/foo.html => assets/foo.html
   let path = root ? root + '/' + filename : filename
-
-  if (!options.allowAbsoluteRoot) {
-    path = path.replace(/^\.?\//, '')
-  } else {
-    // assets => /assets
-    path = path.replace(/^(?!\/)/, '/')
-    // /assets/foo/../bar => /assets/bar
-    path = normalizeFilePath(path)
-  }
+  path = path.replace(/^\.?\//, '')
 
   return path
 }