static file: Symlinks that point to outside of static directory

[skirino]

Hi,

The current version (we are using 0.19.0) of starlette staticfile resolves symlink's path and checks if the resolved path resides in the static file directory.
relevant code: lookup_path() https://github.com/encode/starlette/blob/master/starlette/staticfiles.py#L156-L170
This rejects valid symlinks that reside in the static directory but point to files outside of static directory. Is it OK to quit using realpath() and instead use e.g. normpath() (string manipulation without syscall)? If yes I'll be happy to submit a PR.

cf. flask's implementation does not resolve symlink's realpath.

• https://github.com/pallets/werkzeug/blob/main/src/werkzeug/utils.py#L547-L589
• https://github.com/pallets/werkzeug/blob/main/src/werkzeug/security.py#L110-L140

Our context:
We are uisng bazel and rules_python, and we have dagster project. When running dagit (dagster's web UI) using bazel, bazel prepares symlinks for each of dagit's source files (including .py, .js, etc.). The symlinks for .js and .css happen to live outside of the static directory and cannot be returned to web browser (404 error).

[aminalaee]

Hey,
If I get your point correctly, there's already an open PR for this: #1377
Feel free to review it.

[skirino]

Thank you for the response and the PR! Sorry I failed to search the issue/PR.

[Kludex]

This was solved at some point.