-
-
Notifications
You must be signed in to change notification settings - Fork 997
Description
When using serveStatic with @hono/node-server, if a requested file in the static directory is a symbolic link, the server returns the content of the symlink (the relative path string) instead of following the link and serving the target file's content.
Steps to Reproduce
-
Setup a minimal Hono project with
@hono/node-server -
Create a static directory structure with a symlink:
mkdir -p static echo "<h1>Hello World</h1>" > actual.html cd static ln -s ../actual.html index.html
-
Configure serveStatic:
import { serve } from "@hono/node-server"; import { serveStatic } from "@hono/node-server/serve-static"; import { Hono } from "hono"; const app = new Hono(); // Issue occurs regardless of relative or absolute path in 'root' app.get("/*", serveStatic({ root: "./static" })); serve(app);
-
Request the symlinked file:
curl http://localhost:3000/index.html
Expected Behavior
The server should resolve the symlink and return the content of actual.html (<h1>Hello World</h1>).
Actual Behavior
(Content-Length matches the length of the path string).
Environment:
Node.js: v22.15.1
hono: ^4.10.6
@hono/node-server: ^1.19.6
OS: macOS (Darwin 24.6.0)
It seems serveStatic might be using a file reading method that does not automatically dereference symlinks (e.g., reading the file descriptor of the link itself) or is explicitly checking file stats but not handling isSymbolicLink() correctly before reading.