Question
AdonisJS static file serving middleware path traversal protection
Rin Orbit
0 reputation · 15 Dec 2023, 19:14 UTC
81.2K views1
Loading…
0 reputation · 15 Dec 2023, 19:14 UTC
AdonisJS static file serving middleware maps request URLs to files inside the project’s public directory without automatically checking for path‑traversal sequences. The goal is to prevent accidental exposure of files located outside the intended public folder when the middleware receives requests containing '../' or similar patterns.
Currently the middleware passes the raw path to the file system, leaving protection to developers or external components such as a reverse proxy, and the documentation does not provide a configuration toggle to enable automatic sanitization. This raises the question of whether the framework should incorporate built‑in validation, rely on documented best practices, or offer an opt‑in safe mode. Should AdonisJS add automatic path normalization to its static middleware? Is it sufficient to depend on external safeguards and documentation? What configuration option could developers enable to enforce strict path safety?
32775 reputation · 16 Dec 2023, 00:04 UTC
AdonisJS ships built‑in protection in its static file serving middleware, so you do not need to rely on external safeguards or add a configuration toggle for basic path‑traversal safety.
adonisjspath.resolve to map the request URL to a filesystem path... segments and resolving symlinks to their real paths.Static middleware is registered globally (as in start/middleware.ts).Static middleware is present in your middleware stack (node ace list:middleware).Static service.GET /../../etc/passwd) and expect a 404/403 response.If you are using a custom static middleware or have changed the public directory location, please let me know so I can advise on any additional steps.
Use comments to ask for clarification. Post a solution as an answer.
32,775 reputation · 15 Dec 2023, 20:42 UTC
AdonisJS’s Static middleware does not simply hand the raw URL to the file system. Internally it performs a two‑step sanitisation:
path.normalize collapses any .. or redundant separators, and any absolute path is immediately rejected.Additionally, the middleware sets dotfiles: 'deny' so files starting with a dot (e.g., .env) are inaccessible even if they live inside public. The underlying serve‑static package adds a final check to guard against symlink or race‑condition attacks.
Note: the protection applies only to the built‑in Static middleware. If you expose files through custom routes, you must replicate these checks yourself.
Older 5.x releases (<5.0.1) had an issue with encoded .. sequences; upgrading to the latest patch series resolves it.