Migrate res.sendFile options
Express 5 changes several res.sendFile options, mirroring the express.static
changes:
- The
dotfilesoption now also applies to hidden directories in the path, not
just hidden files. In Express 4 a hidden directory in the path was served by
default; Express 5 returns a 404 Not Found unless you opt in with
dotfiles: 'allow'. - The
hiddenoption is removed and replaced bydotfiles. - The
fromoption (an undocumented alias forroot) is removed and replaced byroot.
This codemod updates res.sendFile() calls to preserve the Express 4 behavior:
- Adds an explicit
dotfiles: 'allow'option to calls that don't already specify adotfiles(orhidden) option. - Renames
hiddentodotfiles(hidden: true→dotfiles: 'allow',hidden: false→dotfiles: 'ignore'). - Renames
fromtoroot.
Only calls whose receiver is a response object (a route/middleware handler
parameter, e.g. the res in (req, res) => res.sendFile(...)) are rewritten.
Example
With existing options
Removed hidden / from options
With a trailing callback
The options object is inserted before the callback:
Security Consideration
After running this codemod, review each res.sendFile() call to determine if
serving dotfiles is actually necessary for your application. If you don't need to
serve dotfiles, you can:
- Remove the
dotfiles: 'allow'option to use the new Express 5 default ("ignore") - Or explicitly set
dotfiles: 'deny'to return a 403 Forbidden for dotfile requests
Note that passing a root option scopes the dotfiles check to the part of the
path relative to root, so a hidden directory in root itself is unaffected.