Merge pull request from GHSA-62jr-84gf-wmg4

Signed-off-by: Matteo Collina <hello@matteocollina.com>
Co-authored-by: Nick O'Leary <nick.oleary@gmail.com>

lib/routes.js

@@ -207,22 +207,24 @@ function fastifySwagger (fastify, opts, done) {
     decorateReply: false
   })
 
-  fastify.register(fastifyStatic, {
-    root: opts.baseDir || path.join(__dirname, '..'),
-    serve: false
-  })
+  if (opts.baseDir) {
+    fastify.register(fastifyStatic, {
+      root: opts.baseDir,
+      serve: false
+    })
 
-  // Handler for external documentation files passed via $ref
-  fastify.route({
-    url: '/*',
-    method: 'GET',
-    schema: { hide: true },
-    ...hooks,
-    handler: function (req, reply) {
-      const file = req.params['*']
-      reply.sendFile(file)
-    }
-  })
+    // Handler for external documentation files passed via $ref
+    fastify.route({
+      url: '/*',
+      method: 'GET',
+      schema: { hide: true },
+      ...hooks,
+      handler: function (req, reply) {
+        const file = req.params['*']
+        reply.sendFile(file)
+      }
+    })
+  }
 
   done()
 }

test/route.test.js

@@ -495,6 +495,19 @@ test('/documentation/ should redirect to ./static/index.html', async (t) => {
   t.equal(res.headers.location, './static/index.html')
 })
 
+test('/documentation/* should not return module files when baseDir not set', async (t) => {
+  t.plan(1)
+  const fastify = Fastify()
+  await fastify.register(fastifySwagger, swaggerOption)
+  await fastify.register(fastifySwaggerUi)
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/documentation/README.md'
+  })
+  t.equal(res.statusCode, 404)
+})
+
 test('should return silent log level of route /documentation', async (t) => {
   const fastify = Fastify()