regression

[tj]

Mr. Deathspike mentioned that GET /about used to 404 but now gets http://pastebin.com/c5vW0hus, look into it

[tj]

windows only

[ForbesLindesay]

Line 307 makes an odd check. The root in my understanding is the location on the physical disk of the root of the file system, and then path is the path from that point to the actual file, so joining the two should return the full path to the file? So why should the path start with root?

[wshaver]

expressjs/express#1229 (comment)

This is the reason, but I don't know where in express the code should go to normalize the path.

[tj]

@wshaver we could normalize in .root() though this line should do that https://github.com/visionmedia/send/blob/master/lib/send.js#L300

[oneill]

Line 300 normalizes the full path (root + path), but on line 307, the normalized full path is checked against the still non normalized root, which may return false, for example when root contains ".." (issue #2) or backslashes.

[ForbesLindesay]

So the solution seems to be to normalize the path too?

[tj]

@oneill ah you're right i missed that