From 2fdddc761d835c1c80d88ace66f027ef54dca684 Mon Sep 17 00:00:00 2001 From: Godwin Iyke Date: Tue, 12 May 2026 20:04:42 -0700 Subject: [PATCH 1/6] Implement handling for special files with size 0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added an opt‑in flag to send (the module Express uses under the hood). This way, developers can explicitly allow streaming of special files like /proc/*, The option defaults to false and returns zero-size files as before. Since developers would want a easier way to access the /proc file on linux systems. usage: app.get('/download', (req, res) => { res.download('/proc/meminfo', 'meminfo.txt', { allowSpecialFiles: true // new opt‑in flag }); }); --- index.js | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/index.js b/index.js index 1655053..008075e 100644 --- a/index.js +++ b/index.js @@ -579,6 +579,20 @@ SendStream.prototype.send = function send (path, stat) { opts.start = offset opts.end = Math.max(offset, offset + len - 1) + // Special file handling: size=0 but readable + const isSpecialFile = stat.size === 0 && this.options.allowSpecialFiles; + + if (isSpecialFile) { + // Skip Content-Length, just stream + debug('special file streaming without Content-Length'); + if (req.method === 'HEAD') { + res.end(); + return; + } + this.stream(path, options); // stream without start/end + return; + } + // content-length res.setHeader('Content-Length', len) From 48f1f261da12a0abfe528e3c18612e0884553f96 Mon Sep 17 00:00:00 2001 From: Godwin Iyke Date: Tue, 12 May 2026 20:13:02 -0700 Subject: [PATCH 2/6] Add tests for streaming special files in send.js Spins up a tiny HTTP server using send. First test: with { allowSpecialFiles: true }, /proc/meminfo streams correctly and contains "MemTotal". Second test: without the flag, the response is empty (current behavior). --- test/send.js | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/test/send.js b/test/send.js index b824282..176610a 100644 --- a/test/send.js +++ b/test/send.js @@ -1279,6 +1279,41 @@ describe('send(file, options)', function () { }) }) + describe('send special files', function () { + it('should stream /proc/meminfo when allowSpecialFiles is true', function (done) { + var app = http.createServer(function (req, res) { + send(req, '/proc/meminfo', { allowSpecialFiles: true }).pipe(res) + }) + + request(app) + .get('/') + .expect(200) + .expect('Content-Type', /plain|text/) + .end(function (err, res) { + if (err) return done(err) + // /proc/meminfo should contain "MemTotal" + assert.ok(res.text.includes('MemTotal')) + done() + }) + }) + + it('should return empty when allowSpecialFiles is false', function (done) { + var app = http.createServer(function (req, res) { + send(req, '/proc/meminfo').pipe(res) + }) + + request(app) + .get('/') + .expect(200) + .end(function (err, res) { + if (err) return done(err) + // Without the flag, Content-Length is 0 + assert.strictEqual(res.text, '') + done() + }) + }) + }) + describe('when missing', function () { it('should consider .. malicious', function (done) { var app = http.createServer(function (req, res) { From 9b293355c415ce67f3549485b1fcec79b1dfdcab Mon Sep 17 00:00:00 2001 From: Godwin Iyke Date: Thu, 14 May 2026 19:46:31 -0700 Subject: [PATCH 3/6] Document allowSpecialFiles in README Added documentation for allowSpecialFiles configuration. --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 350fccd..d959fe1 100644 --- a/README.md +++ b/README.md @@ -111,6 +111,10 @@ This can also be a string accepted by the Serve files relative to `path`. +##### allowSpecialFiles + +When true Serve files in linux based systems ( in folders like /proc ), defaiult false files return a size=0. + ##### start Byte offset at which the stream starts, defaults to 0. The start is inclusive, From 0cedcb239887e7ac3536771266625706afd63e3b Mon Sep 17 00:00:00 2001 From: Godwin Iyke Date: Thu, 14 May 2026 19:48:08 -0700 Subject: [PATCH 4/6] Fix typo and clarify default behavior in README Corrected the spelling of 'default' and clarified its meaning. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d959fe1..4882eec 100644 --- a/README.md +++ b/README.md @@ -113,7 +113,7 @@ Serve files relative to `path`. ##### allowSpecialFiles -When true Serve files in linux based systems ( in folders like /proc ), defaiult false files return a size=0. +When true Serve files in linux based systems ( in folders like /proc ), default is set to false and files return a size=0. ##### start From 311e304e71eb4c475cd5c5aa7a0a4e3ba2b42a88 Mon Sep 17 00:00:00 2001 From: Godwin Iyke Date: Thu, 14 May 2026 19:49:24 -0700 Subject: [PATCH 5/6] Reorganize 'allowSpecialFiles' section in README Moved 'allowSpecialFiles' section to a more appropriate location in the README. --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 4882eec..9fc98cb 100644 --- a/README.md +++ b/README.md @@ -43,6 +43,10 @@ Enable or disable accepting ranged requests, defaults to true. Disabling this will not send `Accept-Ranges` and ignore the contents of the `Range` request header. +##### allowSpecialFiles + +When true Serve files in linux based systems ( in folders like /proc ), default is set to false and files return a size=0. + ##### cacheControl Enable or disable setting `Cache-Control` response header, defaults to @@ -111,10 +115,6 @@ This can also be a string accepted by the Serve files relative to `path`. -##### allowSpecialFiles - -When true Serve files in linux based systems ( in folders like /proc ), default is set to false and files return a size=0. - ##### start Byte offset at which the stream starts, defaults to 0. The start is inclusive, From ecfc934ebcf1c9cadb50f10227b71799c319d8bc Mon Sep 17 00:00:00 2001 From: Godwin Iyke Date: Thu, 14 May 2026 20:01:59 -0700 Subject: [PATCH 6/6] Add support for special file handling option Add support for special file handling option also added the default value for the allowSpecialFiles option. --- index.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index 008075e..4c9f08b 100644 --- a/index.js +++ b/index.js @@ -103,6 +103,10 @@ function SendStream (req, path, options) { ? Boolean(opts.acceptRanges) : true + this._allowSpecialFiles = opts.allowSpecialFiles !== undefined + ? Boolean(opts.allowSpecialFiles) + : false + this._cacheControl = opts.cacheControl !== undefined ? Boolean(opts.cacheControl) : true @@ -580,7 +584,7 @@ SendStream.prototype.send = function send (path, stat) { opts.end = Math.max(offset, offset + len - 1) // Special file handling: size=0 but readable - const isSpecialFile = stat.size === 0 && this.options.allowSpecialFiles; + const isSpecialFile = stat.size === 0 && this._allowSpecialFiles; if (isSpecialFile) { // Skip Content-Length, just stream