fix: improve serve-static function #261
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fix: enable to serve filename with double dots
As described in the hono core, filenames such as
foo..bar.txt
should be accepted.https://github.com/honojs/hono/blob/530ab09ae10caf33903dfb677dff239df01d5ded/src/utils/filepath.test.ts#L13-L17
refactor: simplify serve-static() function
Security check
Since the only untrusted string is
c.req.path
, I think the check should only be done in the following location.https://github.com/honojs/node-server/compare/main...usualoma:node-server:refactor-serve-static?expand=1#diff-85001ab5aae1b04893fe64f90842d5e368e62920e6655ccc1792aa4dff852794R73-R80
I don't think any invalid strings will be entered here.
https://github.com/honojs/node-server/compare/main...usualoma:node-server:refactor-serve-static?expand=1#diff-85001ab5aae1b04893fe64f90842d5e368e62920e6655ccc1792aa4dff852794L102-L106
Stop calling
resolve()
If security checks have been completed, I don't think it's necessary to call
resolve()
inserveStatic()
.