Handle errors for bad symlinks

src/index.js

@@ -697,7 +697,20 @@ module.exports = async (request, response, config = {}, methods = {}) => {
 	// resolve the symlink and run a new `stat` call just for the
 	// target of that symlink.
 	if (isSymLink) {
-		absolutePath = await handlers.realpath(absolutePath);
+		try {
+			absolutePath = await handlers.realpath(absolutePath);
+		} catch (err) {
+			if (err.code !== 'ENOENT') {
+				throw err;
+			}
+
+			// The requested symlink is invalid
+			return handlers.sendError(absolutePath, response, acceptsJSON, current, handlers, config, {
+				statusCode: 404,
+				code: 'not_found',
+				message: 'The requested path could not be found'
+			});
+		}
 		stats = await handlers.lstat(absolutePath);
 	}
 

test/fixtures/symlinks/a-bad-link

@@ -0,0 +1 @@
+not-a-file

test/integration.test.js

@@ -1343,6 +1343,20 @@ test('allow symlinks by setting the option', async () => {
 	expect(text).toBe(spec);
 });
 
+test('A bad symlink should be a 404', async () => {
+	const name = 'symlinks/a-bad-link';
+
+	const url = await getUrl({
+		symlinks: true
+	});
+
+	const response = await fetch(`${url}/${name}`);
+	expect(response.status).toBe(404);
+
+	const text = await response.text();
+	expect(text.trim()).toBe('<span>Not Found</span>');
+});
+
 test('etag header is set', async () => {
 	const url = await getUrl({
 		renderSingle: true,