When the directory itself being a symlink does not work.
My test code:
from fastapi import FastAPI
import uvicorn
from staticfiles import StaticFiles
app = FastAPI()
app.mount("/music", StaticFiles(directory="/home/hanxi/work/xiaomusic/music", follow_symlink=True), name="music")
uvicorn.run(
app,
host=["::", "0.0.0.0"],
port=3333,
)
The directory /home/hanxi/work/xiaomusic/music is a symlink.
> ls -l /home/hanxi/work/xiaomusic/music
lrwxrwxrwx 1 hanxi hanxi 26 Apr 30 12:10 /home/hanxi/work/xiaomusic/music -> /home/hanxi/nas/data/music
I fix this in https://github.com/hanxi/starlette/commit/831cb5d255832d9f704ffd7be49b4184cd301dd6
Need pr?
[!IMPORTANT]
- We're using Polar.sh so you can upvote and help fund this issue.
- We receive the funding once the issue is completed & confirmed by you.
- Thank you in advance for helping prioritize & fund our backlog.
I guess this makes sense. We did have a security advisory about symlinks, so I'm a bit cautious.
Would you like to create a PR? Also, check the advisory https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px and see if we will not introduce something similar. 🙏
Thanks!
I test GHSA-v5gw-mw7f-84px case. test result is 404 Not Found. Review PR #2711 please. Thanks!
It seems this PR caused some unexpected issues around:
- https://github.com/encode/starlette/issues/2788
- https://github.com/encode/starlette/issues/2873
- https://github.com/encode/starlette/pull/2851
I'm thinking about reverting this. Why does it benefit you having the directory as a symlink? @hanxi
I have a music directory that is shared by two web services. One of the web services uses it. Without changing the relative path, I created a symbolic link to music in the current directory of the web service.
eg:
/data/music is origin directory,
/web1/music and /web2/music link to /data/music。 web service is /web1/app.py and /web2/app.py.
If the code is rolled back, I want a new option to be able to handle this situation.
@Kludex
Please see if this helps https://github.com/encode/starlette/pull/2896