File not found when trying to access static files behind a directory symlink

[MightyDuke]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Trying to get a static file behind a directory symlink will return a 404 error, despite being able to browse the directory when directory_view=True is used.

Code snippet

app.static("/static", "directory_with_a_directory_symlink/", directory_view=True)

Expected Behavior

Serve the file, don't return 404.

How do you run Sanic?

As a module

Operating System

Linux

Sanic Version

25.3.0

Additional context

For example, have a directory structure like this:

.
├── app.py
├── static
│   ├── myfiles -> (symlink to ../myfiles/)
└── myfiles
    ├── myfile1.txt
    ├── myfile2.txt
    └── myfile3.txt

Have Sanic serve the static directory:

app.static("/", "static/", directory_view=True)

When you now run the app and go to /myfiles you can see the files in the myfiles directory, however when you click on any of the files 404 Not Found error is returned.

[Tronic]

Following symlinks is easily a security hole to get outside of intended static file location. I believe the prevention of that to be intentional.

You can probably circumvent that by using

app.static("/", "static/", name="static_root")  # If you need to access something else there
app.static("/myfiles", "myfiles/", name="static_myfiles") # Signify intention to allow access outside of static/

[Tronic]

directory_view=True is intended to lessen security, but if it has the side effect of following symlinks outside of the local static root directory, this is indeed not to be expected. Anyone willing to dig into the static files module to verify and make it consistent?

[ChihweiLHBird]

By the way, I think we should return 403 or 404 rather than 500 when directory_view=False and the user is trying to access the directory path.

[ChihweiLHBird]

directory_view=True is intended to lessen security, but if it has the side effect of following symlinks outside of the local static root directory, this is indeed not to be expected. Anyone willing to dig into the static files module to verify and make it consistent?

So do you mean we should hide the symlinks, which link to outside of the static directory, on the directory view page? I can look into it.