Enhance send to stream special files safely

README.md

@@ -43,6 +43,10 @@ Enable or disable accepting ranged requests, defaults to true.
 Disabling this will not send `Accept-Ranges` and ignore the contents
 of the `Range` request header.
 
+##### allowSpecialFiles
+
+When true Serve files in linux based systems ( in folders like /proc ), default is set to false and files return a size=0.
+
 ##### cacheControl
 
 Enable or disable setting `Cache-Control` response header, defaults to

index.js

@@ -103,6 +103,10 @@ function SendStream (req, path, options) {
     ? Boolean(opts.acceptRanges)
     : true
 
+  this._allowSpecialFiles = opts.allowSpecialFiles !== undefined
+    ? Boolean(opts.allowSpecialFiles)
+    : false
+
   this._cacheControl = opts.cacheControl !== undefined
     ? Boolean(opts.cacheControl)
     : true
@@ -579,6 +583,20 @@ SendStream.prototype.send = function send (path, stat) {
   opts.start = offset
   opts.end = Math.max(offset, offset + len - 1)
 
+  // Special file handling: size=0 but readable
+  const isSpecialFile = stat.size === 0 && this._allowSpecialFiles;
+
+  if (isSpecialFile) {
+    // Skip Content-Length, just stream
+    debug('special file streaming without Content-Length');
+    if (req.method === 'HEAD') {
+      res.end();
+      return;
+    }
+    this.stream(path, options); // stream without start/end
+    return;
+  }
+
   // content-length
   res.setHeader('Content-Length', len)
 

test/send.js

@@ -1279,6 +1279,41 @@ describe('send(file, options)', function () {
       })
     })
 
+    describe('send special files', function () {
+      it('should stream /proc/meminfo when allowSpecialFiles is true', function (done) {
+        var app = http.createServer(function (req, res) {
+          send(req, '/proc/meminfo', { allowSpecialFiles: true }).pipe(res)
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .expect('Content-Type', /plain|text/)
+          .end(function (err, res) {
+            if (err) return done(err)
+            // /proc/meminfo should contain "MemTotal"
+            assert.ok(res.text.includes('MemTotal'))
+            done()
+          })
+      })
+
+      it('should return empty when allowSpecialFiles is false', function (done) {
+        var app = http.createServer(function (req, res) {
+          send(req, '/proc/meminfo').pipe(res)
+        })
+
+        request(app)
+          .get('/')
+          .expect(200)
+          .end(function (err, res) {
+            if (err) return done(err)
+            // Without the flag, Content-Length is 0
+            assert.strictEqual(res.text, '')
+            done()
+          })
+      })
+    })
+
     describe('when missing', function () {
       it('should consider .. malicious', function (done) {
         var app = http.createServer(function (req, res) {