Merge commit from fork

Author: mcollina

README.md

@@ -215,9 +215,12 @@ The following options are also supported and will be passed directly to the
 - [`index`](https://www.npmjs.com/package/@fastify/send#index)
 - [`lastModified`](https://www.npmjs.com/package/@fastify/send#lastmodified)
 - [`maxAge`](https://www.npmjs.com/package/@fastify/send#maxage)
+- [`onFile`](https://www.npmjs.com/package/@fastify/send#onfile)
 
 These options can be altered when calling `reply.sendFile('filename.html', options)` or `reply.sendFile('filename.html', 'otherfilename.html', options)` on each response.
 
+`onFile(path, stat)` receives the selected file's absolute path and file system statistics. It may return a promise, which is awaited before response processing and streaming begin. A thrown error or rejected promise aborts the operation and is handled by Fastify's error pipeline. When `allowedPath` is configured, final-path authorization runs first; denied files do not invoke `onFile`.
+
 #### `redirect`
 
 Default: `false`
@@ -254,10 +257,10 @@ when using the `wildcard: false` option.
 
 Default: `(pathName, root, request) => true`
 
-This function filters served files. Accepted `pathName` values are normalized before the callback runs; non-canonical forms such as `//file`, `/./file`, and `/path//file` are rejected. A root-relative filesystem alias that resolves a candidate with different letter casing is rejected before that candidate is authorized or served. Using the request object, complex path authentication is possible.
-Returning `true` serves the file; returning `false` calls Fastify's 404 handler.
+This function filters served files. It runs for the normalized requested `pathName` and may run again when index or extension resolution selects a different final logical path. Final paths use the same leading-slash or relative style as the requested path and are relative to the `root` that selected the file. When `sendFile` is called with an absolute path and no root, `root` is `undefined` and requested and final paths remain absolute. Non-canonical forms such as `//file`, `/./file`, and `/path//file` are rejected. A root-relative filesystem alias that resolves a candidate with different letter casing is rejected before that candidate is authorized or served. Using the request object, complex path authentication is possible.
+Returning `true` from every invocation serves the file; returning `false` for either the requested or final path calls Fastify's 404 handler.
 
-When using `preCompressed: true`, `allowedPath` receives the requested path rather than the selected `.br` or `.gz` variant; see the `preCompressed` note below before using extension-based access rules.
+When using `preCompressed: true`, `.br`, `.gz`, and `.deflate` representations are authorized as their logical uncompressed path. For example, a selected compressed index is authorized as `/dir/index.html`, not `/dir/index.html.br`; see the `preCompressed` note below before using extension-based access rules.
 
 #### `index`
 
@@ -478,7 +481,7 @@ First, try to send the brotli encoded asset (if supported by `Accept-Encoding` h
 
 When `preCompressed` is enabled the response includes `Vary: Accept-Encoding`, because the served variant is selected from the request `Accept-Encoding` header. This applies even when the uncompressed file is sent as a fallback, so that shared caches do not return the wrong variant to clients with a different `Accept-Encoding`.
 
-> ⚠ Warning: `allowedPath` is evaluated against the requested path rather than the selected pre-compressed variant. A request for `/file.txt` can serve `/file.txt.gz` or `/file.txt.br` when the client accepts that encoding, even if direct requests to `.gz` or `.br` files are denied by `allowedPath`. Treat pre-compressed files as public alternate encodings of the same asset: keep restricted compressed files outside the served root, disable `preCompressed`, or deny the base path too.
+> ⚠ Warning: `allowedPath` evaluates pre-compressed variants as their logical uncompressed paths. A request for `/file.txt` can serve `/file.txt.gz`, `/file.txt.br`, or `/file.txt.deflate` when the client accepts that encoding, without separately authorizing the compression suffix. Treat pre-compressed files as alternate encodings of the same asset and apply access rules to the logical path.
 
 Assume this structure with the compressed asset as a sibling of the uncompressed counterpart:
 

index.js

@@ -24,6 +24,7 @@ const asteriskRegex = /\*/gu
 const dotDotSegmentRegex = /(?:^|[\\/])\.\.(?:[\\/]|$)/u
 const leadingDotDotSegmentRegex = /^\/?\.\.(?:[\\/]|$)/u
 const encodedHashOrQuestionMarkRegex = /%(?:23|3f)/giu
+const finalPathDenied = Symbol('finalPathDenied')
 
 const supportedEncodings = ['br', 'gzip', 'deflate']
 send.mime.default_type = 'application/octet-stream'
@@ -68,7 +69,8 @@ async function fastifyStatic (fastify, opts) {
     immutable: opts.immutable,
     index: opts.index,
     lastModified: opts.lastModified,
-    maxAge: opts.maxAge
+    maxAge: opts.maxAge,
+    onFile: opts.onFile
   }
 
   let prefix = opts.prefix ??= '/'
@@ -110,7 +112,7 @@ async function fastifyStatic (fastify, opts) {
         opts,
         undefined,
         allowedPath !== undefined
-      )
+      ).catch((error) => this.send(error))
       return this
     })
 
@@ -133,7 +135,7 @@ async function fastifyStatic (fastify, opts) {
           opts,
           undefined,
           allowedPath !== undefined
-        )
+        ).catch((error) => this.send(error))
 
         return this
       }
@@ -162,7 +164,7 @@ async function fastifyStatic (fastify, opts) {
             return reply.callNotFound()
           }
 
-          pumpSendToReply(
+          return pumpSendToReply(
             req,
             reply,
             pathname,
@@ -274,6 +276,7 @@ async function fastifyStatic (fastify, opts) {
     const pathnameOrig = pathname
     const normalizedPathname = normalizeRequestPathname(pathname)
     const options = Object.assign({}, sendOptions, pumpOptions)
+    const callerOnFile = options.onFile
 
     if (rootPath) {
       if (Array.isArray(rootPath)) {
@@ -361,14 +364,50 @@ async function fastifyStatic (fastify, opts) {
       return reply.callNotFound()
     }
 
+    if (allowedPath && (callerOnFile === undefined || typeof callerOnFile === 'function')) {
+      options.onFile = async function authorizeFinalPath (selectedPath, selectedStat) {
+        let logicalPath = selectedPath
+        const encodingExtension = encodingExtensionMap[encoding]
+        if (encodingExtension && logicalPath.endsWith(encodingExtension)) {
+          logicalPath = logicalPath.slice(0, -encodingExtension.length)
+        }
+
+        const finalPathname = getFinalPathname(
+          logicalPath,
+          options.root,
+          normalizedPathname.startsWith('/')
+        )
+        if (
+          finalPathname === undefined ||
+          (finalPathname !== normalizedPathname && !allowedPath(finalPathname, options.root, request))
+        ) {
+          throw finalPathDenied
+        }
+
+        if (callerOnFile) {
+          await callerOnFile(selectedPath, selectedStat)
+        }
+      }
+    }
+
     // `send(..., path, ...)` will URI-decode path so we pass an encoded path here
+    let sendResult
+    try {
+      sendResult = await send(request.raw, encodeURI(pathnameForSend), options)
+    } catch (error) {
+      if (error === finalPathDenied) {
+        return reply.callNotFound()
+      }
+      throw error
+    }
+
     const {
       statusCode,
       headers,
       stream,
       type,
       metadata
-    } = await send(request.raw, encodeURI(pathnameForSend), options)
+    } = sendResult
     switch (type) {
       case 'directory': {
         const path = metadata.path
@@ -659,6 +698,33 @@ function normalizeRequestPathname (pathname) {
   return path.posix.normalize(pathname)
 }
 
+/**
+ * Convert the absolute path selected by @fastify/send back to the pathname
+ * style used by allowedPath.
+ *
+ * @param {string} selectedPath
+ * @param {string|undefined} root
+ * @param {boolean} leadingSlash
+ * @returns {string|undefined}
+ */
+function getFinalPathname (selectedPath, root, leadingSlash) {
+  if (root === undefined) {
+    return selectedPath
+  }
+
+  const relativePath = path.relative(path.resolve(root), selectedPath)
+  if (
+    relativePath === '..' ||
+    relativePath.startsWith('..' + path.sep) ||
+    path.isAbsolute(relativePath)
+  ) {
+    return
+  }
+
+  const posixPath = relativePath.split(path.sep).join(path.posix.sep)
+  return leadingSlash ? '/' + posixPath : posixPath
+}
+
 /**
  * @param {string} pathname
  * @returns {boolean}

package.json

@@ -61,7 +61,7 @@
   "dependencies": {
     "@fastify/accept-negotiator": "^2.0.0",
     "@fastify/error": "^4.0.0",
-    "@fastify/send": "^4.0.0",
+    "@fastify/send": "^4.2.0",
     "content-disposition": "^3.0.0",
     "fastify-plugin": "^6.0.0",
     "fastq": "^1.17.1",