strictAccept: true,
selfBaseUrl: '',
staticMetadata: true,
+ staticPath: undefined, // no reasonable default
trustProxy: true,
querystring,
};
const _scope = _fileScope('serveFile');
this.logger.debug(_scope, 'called', { req: common.requestLogData(req), ctx });
+ // Require a directory field.
+ if (!directory) {
+ this.logger.debug(_scope, 'rejected unset directory', { fileName });
+ return this.handlerNotFound(req, res, ctx);
+ }
+
// Normalize the supplied path, as encoded path-navigation may have been (maliciously) present.
fileName = path.normalize(fileName);