refactor: replace glob package with node:fs/promises

Author: gafreax

index.js

@@ -2,8 +2,8 @@
 
 const path = require('node:path')
 const { fileURLToPath } = require('node:url')
-const { statSync } = require('node:fs')
-const { glob } = require('glob')
+const { statSync, lstatSync, realpathSync } = require('node:fs')
+const { glob } = require('node:fs/promises')
 const fp = require('fastify-plugin')
 const send = require('@fastify/send')
 const encodingNegotiator = require('@fastify/accept-negotiator')
@@ -63,7 +63,6 @@ async function fastifyStatic (fastify, opts) {
         : prefix + '/'
   }
 
-  // Set the schema hide property if defined in opts or true by default
   const routeOpts = {
     constraints: opts.constraints,
     schema: {
@@ -139,25 +138,55 @@ async function fastifyStatic (fastify, opts) {
       for (let rootPath of roots) {
         rootPath = rootPath.split(path.win32.sep).join(path.posix.sep)
         !rootPath.endsWith('/') && (rootPath += '/')
-        const files = await glob('**/**', {
-          cwd: rootPath, absolute: false, follow: true, nodir: true, dot: opts.serveDotFiles, ignore: opts.globIgnore
-        })
-
-        for (let file of files) {
-          file = file.split(path.win32.sep).join(path.posix.sep)
-          const route = prefix + file
-
-          if (routes.has(route)) {
-            continue
-          }
 
-          routes.add(route)
+        const globPattern = opts.serveDotFiles ? '{**/**,.**/**}' : '**/**'
+        const globExclude = opts.globIgnore?.length
+          ? (f) => opts.globIgnore.some(p => path.matchesGlob(f, p))
+          : undefined
+
+        const scanQueue = [{ cwd: rootPath.slice(0, -1), relPrefix: '' }]
+        const visitedDirs = new Set([realpathSync(rootPath.slice(0, -1))])
+
+        const toUnixPath = (p) => p.split(path.win32.sep).join(path.posix.sep)
+        const tryFsSync = (fn, p) => { try { return fn(p) } catch { return null } }
+
+        while (scanQueue.length > 0) {
+          const { cwd: scanCwd, relPrefix } = scanQueue.shift()
+          for await (const f of glob(globPattern, { cwd: scanCwd, exclude: globExclude })) {
+            if (f === '.') continue
+
+            const file = toUnixPath(f)
+            const fullPath = path.join(scanCwd, file)
+            const lstat = tryFsSync(lstatSync, fullPath)
+            if (!lstat || lstat.isDirectory()) continue
+
+            const relFile = relPrefix ? `${relPrefix}/${file}` : file
+
+            if (lstat.isSymbolicLink()) {
+              const stat = tryFsSync(statSync, fullPath)
+              if (!stat) continue
+
+              if (stat.isDirectory()) {
+                const realPath = tryFsSync(realpathSync, fullPath)
+                /* c8 ignore next */
+                if (!realPath) continue
+                if (!visitedDirs.has(realPath)) {
+                  visitedDirs.add(realPath)
+                  scanQueue.push({ cwd: fullPath, relPrefix: relFile })
+                }
+                continue
+              }
+            }
 
-          setUpHeadAndGet(routeOpts, route, `/${file}`, rootPath)
+            const route = prefix + relFile
+            if (routes.has(route)) continue
+            routes.add(route)
+            setUpHeadAndGet(routeOpts, route, `/${relFile}`, rootPath)
 
-          const key = path.posix.basename(route)
-          if (indexes.has(key) && !indexDirs.has(key)) {
-            indexDirs.set(path.posix.dirname(route), rootPath)
+            const key = path.posix.basename(route)
+            if (indexes.has(key) && !indexDirs.has(key)) {
+              indexDirs.set(path.posix.dirname(route), rootPath)
+            }
           }
         }
       }

test/static.test.js

@@ -2517,10 +2517,8 @@ test('if dotfiles are properly served according to plugin options', async (t) =>
 
 test('register with failing glob handler', async (t) => {
   const fastifyStatic = proxyquire.noCallThru()('../', {
-    glob: function globStub (_pattern, _options, cb) {
-      process.nextTick(function () {
-        return cb(new Error('mock glob error'))
-      })
+    'node:fs/promises': {
+      glob: async function * globStub () { throw new Error('mock glob error') }
     }
   })
 
@@ -3353,6 +3351,43 @@ test('should follow symbolic link without wildcard', async (t) => {
   t.assert.deepStrictEqual(response2.status, 200)
 })
 
+test('should not infinite-loop on circular symlinks with wildcard false', async (t) => {
+  const base = path.join(__dirname, '/static-symbolic-link')
+  const dirA = path.join(base, 'circular-a')
+  const linkB = path.join(base, 'circular-b')
+  // clean up any leftovers from a previous failed run
+  try { fs.unlinkSync(path.join(dirA, 'link-to-b')) } catch { /* not there */ }
+  try { fs.unlinkSync(linkB) } catch { /* not there */ }
+  fs.rmSync(dirA, { recursive: true, force: true })
+  fs.mkdirSync(dirA)
+  fs.symlinkSync(path.join(dirA, 'link-to-b'), linkB, 'dir')   // circular-b → circular-a/link-to-b
+  fs.symlinkSync(linkB, path.join(dirA, 'link-to-b'), 'dir')   // circular-a/link-to-b → circular-b
+
+  t.after(() => {
+    try { fs.unlinkSync(path.join(dirA, 'link-to-b')) } catch { /* already gone */ }
+    try { fs.unlinkSync(linkB) } catch { /* already gone */ }
+    try { fs.rmdirSync(dirA) } catch { /* already gone */ }
+  })
+
+  const fastify = Fastify()
+  fastify.register(fastifyStatic, {
+    root: base,
+    wildcard: false
+  })
+  t.after(() => fastify.close())
+
+  // fastify.listen must complete (not hang/crash) — that is the assertion
+  await fastify.listen({ port: 0 })
+  fastify.server.unref()
+
+  // Original non-circular files still served correctly
+  const response = await fetch(
+    'http://localhost:' + fastify.server.address().port + '/origin/subdir/subdir/index.html'
+  )
+  t.assert.ok(response.ok)
+  t.assert.deepStrictEqual(response.status, 200)
+})
+
 test('should serve files into hidden dir with wildcard `false`', async (t) => {
   t.plan(8)