feature: disable root path check when serve is false

[nimesh0505]

Summary

This MR addresses the issue #460 where the checkRootPathForErrors function still requires a valid path to root even when serve: false is set.

Changes

• Disabled checkRootPathForErrors when serve: false.
• Added a unit test to confirm that the root path check is bypassed when serve: false.

Tests

• Added a test in test/static.js to verify that checkRootPathForErrors is not called when serve: false.

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[climba03003]

I don't think simply disable the check is the solution.

1. It may fails to serve file because there is no root provided. You can see the root path is passing everywhere inside the codebase. You must provide test to ensure it will works.
2. It can leads to security issue because it means by default the serving of files can be escaped to everywhere. You should at least default the root to CWD and update the read me.

[Uzlopak]

My remark from three days ago was still not addressed.

Imho this PR does not take in account, that if no general root path is defined, that rootPath parameter of sendFile becomes mandatory.

fastify-static/index.js

Line 84 in 39e89ea

root || sendOptions.root,

[climba03003]

Note that please do not open another PR for updates or address comment.
It is hard to follows.

You should push commit to your branch to address the comments.

[nimesh0505]

@climba03003 Can you review this PR?

[climba03003]

I am think is it necessary to skip the check of root path?
You should never use a invalid root path, defaulting to cwd is a trade-off for security reason.

All of your served file should be contained within to the root and prevent path escape.

[nimesh0505]

@climba03003 Thank you for your feedback on the security implications. Before implementing changes, I would like to confirm the approach that we remove the skipExistenceCheck parameter from the checkPath and checkRootPathForErrors functions since we need perform full validation of the path.

[climba03003]

You can skip for cwd, but you must provide a valid root.
No matter other setting.

[mcollina]

@nimesh0505 @simoneb ping

[simoneb]

Unfortunately we cannot progress on this PR, so I'm closing it.