{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/express/issues/2674","labels_url":"https://api.github.com/repos/strongloop/express/issues/2674/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/express/issues/2674/comments","events_url":"https://api.github.com/repos/strongloop/express/issues/2674/events","html_url":"https://github.com/strongloop/express/issues/2674","id":87370782,"number":2674,"title":"res.sendFile path must be absolute - why?","user":{"login":"SystemParadox","id":1228777,"avatar_url":"https://avatars.githubusercontent.com/u/1228777?v=3","gravatar_id":"","url":"https://api.github.com/users/SystemParadox","html_url":"https://github.com/SystemParadox","followers_url":"https://api.github.com/users/SystemParadox/followers","following_url":"https://api.github.com/users/SystemParadox/following{/other_user}","gists_url":"https://api.github.com/users/SystemParadox/gists{/gist_id}","starred_url":"https://api.github.com/users/SystemParadox/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SystemParadox/subscriptions","organizations_url":"https://api.github.com/users/SystemParadox/orgs","repos_url":"https://api.github.com/users/SystemParadox/repos","events_url":"https://api.github.com/users/SystemParadox/events{/privacy}","received_events_url":"https://api.github.com/users/SystemParadox/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/express/labels/4.x","name":"4.x","color":"ededed"},{"url":"https://api.github.com/repos/strongloop/express/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":{"login":"dougwilson","id":67512,"avatar_url":"https://avatars.githubusercontent.com/u/67512?v=3","gravatar_id":"","url":"https://api.github.com/users/dougwilson","html_url":"https://github.com/dougwilson","followers_url":"https://api.github.com/users/dougwilson/followers","following_url":"https://api.github.com/users/dougwilson/following{/other_user}","gists_url":"https://api.github.com/users/dougwilson/gists{/gist_id}","starred_url":"https://api.github.com/users/dougwilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougwilson/subscriptions","organizations_url":"https://api.github.com/users/dougwilson/orgs","repos_url":"https://api.github.com/users/dougwilson/repos","events_url":"https://api.github.com/users/dougwilson/events{/privacy}","received_events_url":"https://api.github.com/users/dougwilson/received_events","type":"User","site_admin":false},"milestone":null,"comments":1,"created_at":"2015-06-11T14:44:37Z","updated_at":"2015-06-11T16:33:52Z","closed_at":"2015-06-11T16:33:52Z","body":"As of express 4.x, `res.sendfile` is deprecated in favour of `res.sendFile`. However, the new `res.sendFile` does not allow relative paths: `TypeError: path must be absolute or specify root to res.sendFile`.\r\n\r\nMy question is why not?\r\n\r\nIn #2360 @dougwilson claims that `process.cwd()` can change at runtime and that relative paths are bad for security and can break things. I am not clear why or how this issue can occur.\r\n\r\nPlease could someone provide a more detailed explanation for this.\r\n\r\nIf this really is an issue enough to warrant changing the API to prohibit it, may I suggest that the documentation for sendFile should be updated with the explanation? Otherwise, aren't people just going to do one of the following instead? Aren't these subject to the same issue?\r\n\r\n```\r\nres.sendFile(path.join(process.cwd(), file))\r\nres.sendFile(file, { root: process.cwd() })\r\n```\r\n\r\nThanks."},"comment":{"url":"https://api.github.com/repos/strongloop/express/issues/comments/111196832","html_url":"https://github.com/strongloop/express/issues/2674#issuecomment-111196832","issue_url":"https://api.github.com/repos/strongloop/express/issues/2674","id":111196832,"user":{"login":"dougwilson","id":67512,"avatar_url":"https://avatars.githubusercontent.com/u/67512?v=3","gravatar_id":"","url":"https://api.github.com/users/dougwilson","html_url":"https://github.com/dougwilson","followers_url":"https://api.github.com/users/dougwilson/followers","following_url":"https://api.github.com/users/dougwilson/following{/other_user}","gists_url":"https://api.github.com/users/dougwilson/gists{/gist_id}","starred_url":"https://api.github.com/users/dougwilson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dougwilson/subscriptions","organizations_url":"https://api.github.com/users/dougwilson/orgs","repos_url":"https://api.github.com/users/dougwilson/repos","events_url":"https://api.github.com/users/dougwilson/events{/privacy}","received_events_url":"https://api.github.com/users/dougwilson/received_events","type":"User","site_admin":false},"created_at":"2015-06-11T16:33:52Z","updated_at":"2015-06-11T16:33:52Z","body":"> I am not clear why or how this issue can occur.\r\n\r\nJust somewhere in your code, or one of your (probably) many, many dependencies the function `process.chdir()` (https://nodejs.org/api/process.html#process_process_chdir_directory) can be called at runtime, altering the value of `process.cwd()` in the process. Unless you have personally reviewed every line of code in your `node_modules` folder, how can you be sure that won't occur?\r\n\r\n> If this really is an issue enough to warrant changing the API to prohibit it, may I suggest that the documentation for sendFile should be updated with the explanation?\r\n\r\nAs for any documentation changes, please create an issue (or even a PR!) over at https://github.com/strongloop/expressjs.com :)\r\n\r\n> Otherwise, aren't people just going to do one of the following instead? Aren't these subject to the same issue?\r\n\r\nYes, they can do that and they are, but they are now opting into un-secure behavior knowingly, as they would have to understand what `process.cwd()` is and also notice that it's a method call, which signals the value can change at any time.\r\n\r\nThe reason behind the API change was from a security audit from our friends at Nodesecurity.io "}}