Disallow directories in /static (vercel#1028)

timneutkens · arunoda · commit aa971d6a1c48 · 2017-02-08T05:43:25.000+05:30
diff --git a/server/render.js b/server/render.js
@@ -182,6 +182,12 @@ export async function serveStaticWithGzip (req, res, path) {
 export function serveStatic (req, res, path) {
   return new Promise((resolve, reject) => {
     send(req, path)
+    .on('directory', () => {
+      // We don't allow directories to be read.
+      const err = new Error('No directory access')
+      err.code = 'ENOENT'
+      reject(err)
+    })
     .on('error', reject)
     .pipe(res)
     .on('finish', resolve)
