no-static-root-exposure

const express = require('express');
const serveIndex = require('serve-index');
const path = require('path');

// Application root - VULNERABLE (.env, .git, source all public)
app.use(express.static(__dirname));

// Relative root / cwd - VULNERABLE
app.use(express.static('.'));
app.use(express.static(process.cwd()));

// Join without a subdirectory - VULNERABLE
app.use(express.static(path.join(__dirname)));

// Escaping the app directory - VULNERABLE
app.use(express.static(path.join(__dirname, '..', 'shared')));

// Directory listing - VULNERABLE
app.use(serveIndex('/', { icons: true }));

const express = require('express');
const path = require('path');

// Dedicated asset directory - SAFE
app.use(
  express.static(path.join(__dirname, 'public'), {
    index: 'index.html',
    dotfiles: 'ignore',
  }),
);

// Any allowlisted root - SAFE
app.use(express.static('public'));
app.use(express.static(path.join(__dirname, 'dist')));
app.use(express.static(path.join(process.cwd(), 'assets')));

// Custom directory via the allowedRoots option - SAFE
// { allowedRoots: ['www'] }
app.use(express.static(path.join(__dirname, 'www')));

🔒 CWE-548 | Application Root Served Statically (CWE-548) | HIGH
   Fix: Serve a dedicated asset directory instead: express.static(path.join(__dirname, 'public')) | https://cwe.mitre.org/data/definitions/548.html

{
  rules: {
    "express-security/no-static-root-exposure": ["error", {
      allowedRoots: ["public", "static", "dist", "build", "assets"]
    }]
  }
}

app.use(
  express.static(path.join(__dirname, 'public'), {
    dotfiles: 'ignore',
    index: 'index.html',
  }),
);

// Serve an explicit index or a curated file list instead of serve-index
app.get('/files', (req, res) => res.json(CURATED_FILE_LIST));

// eslint config — the team serves from www/
"express-security/no-static-root-exposure": ["error", { allowedRoots: ["www"] }]

// ❌ NOT DETECTED - Root behind a variable
const root = __dirname;
app.use(express.static(root));

// ❌ NOT DETECTED - Destructured binding
const { static: serveStatic } = require('express');
app.use(serveStatic(__dirname));

// ❌ NOT DETECTED - serve-static used directly
const serveStatic = require('serve-static');
app.use(serveStatic(__dirname));

// ❌ NOT DETECTED - Computed access
app.use(express['static']('.'));