Safe Local Document Serving with Range Requests

Serving a local document through a private dashboard creates a filesystem boundary. A route that simply joins a query parameter to a base directory is vulnerable to traversal, symlink escape, and unintended file disclosure.

Resolve the real path

String-prefix checks on an unresolved path are insufficient. The server canonicalizes the approved root and requested file, resolves symlinks, and verifies containment with path separators. Absolute paths, encoded .., null bytes, and malformed encodings are rejected before file access.

Only user-approved roots and PDF, DOCX, and HWP extensions are accepted. Directories and unrelated notes are not served. Unsupported HTTP methods return an error instead of falling through to file logic.

Streaming needs security headers too

PDF viewers commonly issue Range requests. Valid byte ranges receive 206 Partial Content, Content-Range, and the exact content length. Invalid ranges receive 416. Responses use private, no-store caching so personal study materials are not retained by shared caches.

Test attacks, not only valid files

The source check verified that unauthenticated access is rejected, PDFs support byte ranges, private cache headers are present, and malformed paths and methods fail. It also confirmed that personal notes are outside the allowlist. Authentication and path containment are independent controls: either one can fail, so both must be tested.