tomgallacher/gzippo — Issue #14: Going to a directory path without trailing slash exposes system path.
Author: PabloSerbo
Created: 2011-12-10 01:23:33+00:00
State: open

If you go to:

http://www.tomg.co/js

Gzippo passes the filename to the staticSend via pass() on line 159. express then does a 301 and redirect to this path.

Resulting in:

http://www.tomg.co/var/application/Tom/PersonalSite/public/js/

This is a pretty major security concern as it exposes private information about your system.

A directory check should be performed first or the url.pathname should be send to static send for the redirect.