Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

StaticFiles middleware doesn't follow symlinks

See original GitHub issue

Checklist

The bug is reproducible against the latest release and/or master.
There are no similar issues or pull requests to fix it yet.

Describe the bug

The StaticFiles middleware is checking the os.realpath of a file and returning a 404 for symlinks that lead outside the static directory.

To reproduce

create a minimal app with a staticfiles middleware
put a symlink in your static directory. the link’s target must be above the static directory.
you’ll get a 404

Expected behavior

Support symlinks in static directory.

The use case for symlinks in static is to target frontend assets that are being generated in file-watch mode.

Actual behavior

Debugging material

It’s happening here: https://github.com/encode/starlette/blob/b95acea973c20eea3e7cbbca42d09b1f5d4a3412/starlette/staticfiles.py#L147-L149

Environment

OS: linux
Python version: 3.7.5
Starlette version: 0.13.8

Additional context

I’m happy to post a PR for this if useful, ideally adding a bool param to the StaticFiles middleware that allows symlinks.

Issue Analytics

State:
Created 3 years ago
Reactions:5
Comments:16 (9 by maintainers)

Top GitHub Comments

2reactions

Kludexcommented, Jun 10, 2022

Report about the incident: https://github.com/encode/starlette/pull/1681#issuecomment-1152178256

2reactions

Kludexcommented, Jun 10, 2022

Yeah, I’m going to clarify things in a few hours. 👍

Top Results From Across the Web

Unable to symlink static files using express.static() in Next js

I'm prototyping a NextJS implementation with the following server code: import express from 'express'; import next from 'next'; ...

The staticfiles app - Django documentation

django.contrib.staticfiles collects static files from each of your applications (and any other places you specify) into a single location that can easily be ......

Web Server Advanced — aiohttp 3.8.3 documentation

Middlewares and signals from app and admin are chained. It means that if URL is '/admin/something' middlewares from app are applied first and...

Static files in ASP.NET Core | Microsoft Learn

Most apps follow this pattern. When the Static File Middleware is called before the authorization middleware: No authorization checks are ...

Apache is not serving static files from correct directory

The first think I thought is that I have not put the static files in ... allow,deny Options Indexes FollowSymLinks Allow from all...