From 6ce2fd216b2bc84e61229add4a4ee20c45992914 Mon Sep 17 00:00:00 2001
From: Douglas Christopher Wilson <doug@somethingdoug.com>
Date: Mon, 25 Aug 2014 18:56:27 -0400
Subject: [PATCH] Add debug messages

---
 HISTORY.md   |  1 +
 index.js     | 10 ++++++++--
 package.json |  1 +
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/HISTORY.md b/HISTORY.md
index 06e1a6c..199537a 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,6 +1,7 @@
 unreleased
 ==========
 
+  * Add `debug` messages
   * Resolve relative paths at middleware setup
 
 1.1.6 / 2014-08-10
diff --git a/index.js b/index.js
index 7c807a4..e465e01 100644
--- a/index.js
+++ b/index.js
@@ -15,6 +15,7 @@
  */
 
 var accepts = require('accepts');
+var debug = require('debug')('serve-index');
 var http = require('http')
   , fs = require('fs')
   , path = require('path')
@@ -109,10 +110,14 @@ exports = module.exports = function serveIndex(root, options){
     // null byte(s), bad request
     if (~path.indexOf('\0')) return next(createError(400));
 
-    // malicious path, forbidden
-    if (0 != path.indexOf(root)) return next(createError(403));
+    // malicious path
+    if (path.substr(0, root.length) !== root) {
+      debug('malicious path "%s"', path);
+      return next(createError(403));
+    }
 
     // check if we have a directory
+    debug('stat "%s"', path);
     fs.stat(path, function(err, stat){
       if (err && err.code === 'ENOENT') {
         return next();
@@ -128,6 +133,7 @@ exports = module.exports = function serveIndex(root, options){
       if (!stat.isDirectory()) return next();
 
       // fetch files
+      debug('readdir "%s"', path);
       fs.readdir(path, function(err, files){
         if (err) return next(err);
         if (!hidden) files = removeHidden(files);
diff --git a/package.json b/package.json
index 5a6e27a..44b8d07 100644
--- a/package.json
+++ b/package.json
@@ -8,6 +8,7 @@
   "dependencies": {
     "accepts": "~1.0.7",
     "batch": "0.5.1",
+    "debug": "1.0.4",
     "parseurl": "~1.3.0"
   },
   "devDependencies": {