feat(serve-static): support absolute root

runtime-tests/bun/index.test.tsx

@@ -1,4 +1,6 @@
 import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import fs from 'fs/promises'
+import path from 'path'
 import { stream, streamSSE } from '../..//src/helper/streaming'
 import { serveStatic, toSSG } from '../../src/adapter/bun'
 import { createBunWebSocket } from '../../src/adapter/bun/websocket'
@@ -11,7 +13,6 @@ import { Hono } from '../../src/index'
 import { jsx } from '../../src/jsx'
 import { basicAuth } from '../../src/middleware/basic-auth'
 import { jwt } from '../../src/middleware/jwt'
-import { HonoRequest } from '../../src/request'
 
 // Test just only minimal patterns.
 // Because others are tested well in Cloudflare Workers environment already.
@@ -42,7 +43,7 @@ describe('Basic', () => {
 
 describe('Environment Variables', () => {
  it('Should return the environment variable', async () => {
- const c = new Context(new HonoRequest(new Request('http://localhost/')))
+ const c = new Context(new Request('http://localhost/'))
  const { NAME } = env<{ NAME: string }>(c)
  expect(NAME).toBe('Bun')
  })
@@ -107,6 +108,8 @@ describe('Serve Static Middleware', () => {
  })
  )
 
+ app.all('/static-absolute-root/*', serveStatic({ root: path.dirname(__filename) }))
+
  beforeEach(() => onNotFound.mockClear())
 
  it('Should return static file correctly', async () => {
@@ -157,6 +160,13 @@ describe('Serve Static Middleware', () => {
  expect(res.status).toBe(200)
  expect(await res.text()).toBe('Hi\n')
  })
+
+ it('Should return 200 response - /static-absolute-root/plain.txt', async () => {
+ const res = await app.request('http://localhost/static-absolute-root/plain.txt')
+ expect(res.status).toBe(200)
+ expect(await res.text()).toBe('Bun!')
+ expect(onNotFound).not.toHaveBeenCalled()
+ })
 })
 
 // Bun support WebCrypto since v0.2.2
@@ -310,8 +320,6 @@ describe('WebSockets Helper', () => {
  expect(receivedMessage).toBe(message)
  })
 })
-const fs = require('fs').promises
-const path = require('path')
 
 async function deleteDirectory(dirPath) {
  if (

runtime-tests/bun/static-absolute-root/plain.txt

@@ -0,0 +1 @@
+Bun!

runtime-tests/deno/.vscode/settings.json

@@ -1,7 +1,7 @@
 {
  "eslint.validate": ["javascript", "javascriptreact", "typescript", "typescriptreact"],
  "editor.codeActionsOnSave": {
- "source.fixAll.eslint": true
+ "source.fixAll.eslint": "explicit"
  },
  "deno.enable": true
 }

runtime-tests/deno/deno.json

@@ -13,7 +13,8 @@
  ],
  "imports": {
  "@std/assert": "jsr:@std/assert@^1.0.3",
+ "@std/path": "jsr:@std/path@^1.0.3",
  "@std/testing": "jsr:@std/testing@^1.0.1",
  "hono/jsx/jsx-runtime": "../../src/jsx/jsx-runtime.ts"
  }
-}
+}

runtime-tests/deno/middleware.test.tsx

@@ -1,4 +1,5 @@
 import { assertEquals, assertMatch } from '@std/assert'
+import { dirname, fromFileUrl } from '@std/path'
 import { assertSpyCall, assertSpyCalls, spy } from '@std/testing/mock'
 import { serveStatic } from '../../src/adapter/deno/index.ts'
 import { Hono } from '../../src/hono.ts'
@@ -94,6 +95,16 @@ Deno.test('Serve Static middleware', async () => {
  })
  )
 
+ app.get('/static-absolute-root/*', serveStatic({ root: dirname(fromFileUrl(import.meta.url)) }))
+
+ app.get(
+ '/static/*',
+ serveStatic({
+ root: './runtime-tests/deno',
+ onNotFound,
+ })
+ )
+
  let res = await app.request('http://localhost/favicon.ico')
  assertEquals(res.status, 200)
  assertEquals(res.headers.get('Content-Type'), 'image/x-icon')
@@ -132,6 +143,10 @@ Deno.test('Serve Static middleware', async () => {
  res = await app.request('http://localhost/static/hello.world')
  assertEquals(res.status, 200)
  assertEquals(await res.text(), 'Hi\n')
+
+ res = await app.request('http://localhost/static-absolute-root/plain.txt')
+ assertEquals(res.status, 200)
+ assertEquals(await res.text(), 'Deno!')
 })
 
 Deno.test('JWT Authentication middleware', async () => {

runtime-tests/deno/static-absolute-root/plain.txt

@@ -0,0 +1 @@
+Deno!

src/adapter/bun/serve-static.ts

@@ -9,13 +9,13 @@ export const serveStatic = <E extends Env = Env>(
 ): MiddlewareHandler => {
  return async function serveStatic(c, next) {
  const getContent = async (path: string) => {
- path = `./${path}`
+ path = path.startsWith('/') ? path : `./${path}`
  // @ts-ignore
  const file = Bun.file(path)
  return (await file.exists()) ? file : null
  }
  const pathResolve = (path: string) => {
- return `./${path}`
+ return path.startsWith('/') ? path : `./${path}`
  }
  const isDir = async (path: string) => {
  let isDir

src/adapter/deno/serve-static.ts

@@ -20,7 +20,7 @@
  }
  }
  const pathResolve = (path: string) => {
- return `./${path}`
+ return path.startsWith('/') ? path : `./${path}`
  }
  const isDir = (path: string) => {
  let isDir

src/middleware/serve-static/index.test.ts

@@ -226,4 +226,62 @@ describe('Serve Static Middleware', () => {
  expect(res.status).toBe(200)
  expect(res.body).toBe(body)
  })
+
+ describe('Changing root path', () => {
+ const pathResolve = (path: string) => {
+ return path.startsWith('/') ? path : `./${path}`
+ }
+
+ it('Should return the content with absolute root path', async () => {
+ const app = new Hono()
+ const serveStatic = baseServeStatic({
+ getContent,
+ pathResolve,
+ root: '/home/hono/child',
+ })
+ app.get('/static/*', serveStatic)
+
+ const res = await app.request('/static/html/hello.html')
+ expect(await res.text()).toBe('Hello in /home/hono/child/static/html/hello.html')
+ })
+
+ it('Should traverse the directories with absolute root path', async () => {
+ const app = new Hono()
+ const serveStatic = baseServeStatic({
+ getContent,
+ pathResolve,
+ root: '/home/hono/../parent',
+ })
+ app.get('/static/*', serveStatic)
+
+ const res = await app.request('/static/html/hello.html')
+ expect(await res.text()).toBe('Hello in /home/parent/static/html/hello.html')
+ })
+
+ it('Should treat the root path includes .. as relative path', async () => {
+ const app = new Hono()
+ const serveStatic = baseServeStatic({
+ getContent,
+ pathResolve,
+ root: '../home/hono',
+ })
+ app.get('/static/*', serveStatic)
+
+ const res = await app.request('/static/html/hello.html')
+ expect(await res.text()).toBe('Hello in ./../home/hono/static/html/hello.html')
+ })
+
+ it('Should not allow directory traversal with . as relative path', async () => {
+ const app = new Hono()
+ const serveStatic = baseServeStatic({
+ getContent,
+ pathResolve,
+ root: '.',
+ })
+ app.get('*', serveStatic)
+
+ const res = await app.request('///etc/passwd')
+ expect(res.status).toBe(404)
+ })
+ })
 })

src/middleware/serve-static/index.ts

@@ -39,6 +39,18 @@ export const serveStatic = <E extends Env = Env>(
  isDir?: (path: string) => boolean | undefined | Promise<boolean | undefined>
  }
 ): MiddlewareHandler => {
+ let isAbsoluteRoot = false
+ let root: string
+
+ if (options.root) {
+ if (options.root.startsWith('/')) {
+ isAbsoluteRoot = true
+ root = new URL(`file://${options.root}`).pathname
+ } else {
+ root = options.root
+ }
+ }
+
  return async (c, next) => {
  // Do nothing if Response is already set
  if (c.finalized) {
@@ -48,7 +60,6 @@ export const serveStatic = <E extends Env = Env>(
 
  let filename = options.path ?? decodeURI(c.req.path)
  filename = options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename
- const root = options.root
 
  // If it was Directory, force `/` on the end.
  if (!filename.endsWith('/') && options.isDir) {
@@ -71,6 +82,10 @@ export const serveStatic = <E extends Env = Env>(
  return await next()
  }
 
+ if (isAbsoluteRoot) {
+ path = '/' + path
+ }
+
  const getContent = options.getContent
  const pathResolve = options.pathResolve ?? defaultPathResolve
  path = pathResolve(path)

src/utils/filepath.ts

@@ -52,5 +52,9 @@ export const getFilePathWithoutDefaultDocument = (
  let path = root ? root + '/' + filename : filename
  path = path.replace(/^\.?\//, '')
 
+ if (root[0] !== '/' && path[0] === '/') {
+ return
+ }
+
  return path
 }