feat: add followSymlinks option to configure symlink traversal (#120)

README.md

@@ -88,6 +88,11 @@ all methods.
 
 The default value is `true`.
 
+##### followSymlinks
+
+Enable or disable following symbolic links, defaults to `true`. Set to `false`
+to restrict symlink traversal outside root.
+
 ##### immutable
 
 Enable or disable the `immutable` directive in the `Cache-Control` response

index.js

@@ -60,6 +60,9 @@ function serveStatic (root, options) {
   }
 
   // setup options for send
+  opts.followSymlinks = opts.followSymlinks !== undefined
+    ? opts.followSymlinks
+    : true
   opts.maxage = opts.maxage || opts.maxAge || 0
   opts.root = resolve(root)
 

test/test.js

@@ -398,6 +398,30 @@ describe('serveStatic()', function () {
     })
   })
 
+  describe('followSymlinks', function () {
+    it('should default to true', function (done) {
+      request(createServer(fixtures))
+        .get('/todo.txt')
+        .expect(200, '- groceries', done)
+    })
+
+    describe('when false', function () {
+      it('should accept followSymlinks: false', function (done) {
+        request(createServer(fixtures, { followSymlinks: false }))
+          .get('/todo.txt')
+          .expect(200, '- groceries', done)
+      })
+    })
+
+    describe('when true', function () {
+      it('should accept followSymlinks: true', function (done) {
+        request(createServer(fixtures, { followSymlinks: true }))
+          .get('/todo.txt')
+          .expect(200, '- groceries', done)
+      })
+    })
+  })
+
   describe('hidden files', function () {
     var server
     before(function () {