Allow staticfiles to follow symlinks outside directory

[aminalaee]

Fixes #1083.

Right now we don't allow StaticFiles to break outside of statics directory:

starlette/starlette/staticfiles.py

Lines 162 to 165 in 0aef172

	if os.path.commonprefix([full_path, directory]) != directory:
	# Don't allow misbehaving clients to break out of the static files
	# directory.
	continue

Since we already follow symlinks for directory and path, I think it makes sense to allow StaticFiles to break out of statics directory if it's following a symlink.

[euri10]

isn't that behavior a security concern and would allow path traversal ?

[aminalaee]

@euri10 For example in Nginx docs this is the default behaviour it makes sense to break outside of the directory, only if following symlinks.
if I'm not mistaken that's also the case in Django, but I need to double check.

[euri10]

added a few comments mostly about os.path vs pathlib stuff, so not blocking on my side but I would see it as probably more readable

thoughts ?

[euri10]

looks good to me

[Kludex]

Please do not merge until 0.19.1 is released. This should be up on 0.20.0.

[aminalaee]

@Kludex Can we merge this now?

[Kludex]

correct me if I'm wrong, but this PR changes the API from str to Path, and allows staticfiles to follow symlinks outside directory. Right? - just for the release notes

[aminalaee]

correct me if I'm wrong, but this PR changes the API from str to Path, and allows staticfiles to follow symlinks outside directory. Right? - just for the release notes

@Kludex

• About "following symlinks" the answer is yes.
• About "changing API from str to Path" it's a bit tricky. we are changing some methods like get_response and lookup_path but I'm not sure if they are the API here. The main entry to Staticfiles is not changed, but in some cases people might depend on the changed methods, which is not common, and it might break for them. So a note might be useful.

[Kludex]

LGTM! 👍

I've added a comment about an alternative solution, but use whatever you prefer.