How do I convince asp.net MVC static files to follow symbolic links

Question

ASP .NET MVC .UseStaticFiles will not follow symbolic links.

I'm pretty sure this is intentional behavior and an extremely misguided security decision. It might make sense if MBC was used for a wen server hosting a bunch of stuff. It does not make sense for web applications as actually used. If an attacker can place a symbolic link in the wweroot directory he can replace the application binaries.

It appeared to be implemented in PhysicalFileProvider, where it gets the full path and checks if it is under wwwroot. Nope. It's calling System.IO.FileInfo.Length which always returns zero for symbolic links.

How do tell it to shut up? Following a symlink out of wwwroot is not equivalent to somebody having exploited a traversal bug.

Newsboy

Can you provide details to reproduce your issue? For example, are you on Linux, macOS, Windows, Docker? etc. There isn't really enough to go on here. I tried a simple app with symlinks into wwwroot, and it works fine for me. – Durfee

@natemcmaster: I tracked down the actual bug. It's only choking if the file itself is a symbolic link not anything above it. – Newsboy

Answer 1

It's bugged in MVC Core. See https://github.com/aspnet/Home/issues/2774

Only possible solution:

HostingEnvironment.WebRootProvider = your own provider

Where your provider must not replicate the bug of calling System.IO.FileInfo.Length.

Newsboy

Answer 2

I found that when you symlink not the file but the directory containing the file, the file loads completely.

Tracheo

Having found the actual bug in .NET source, this does not surprise me. – Newsboy