Commitf479cc5

authored

fix(dev): trim trailing slash beforeserver.fs.deny check (#20968)

1 parent5adbc53 commitf479cc5Copy full SHA for f479cc5

File tree

+31

-2

lines changed

+31

-2

lines changed

Lines changed: 6 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -297,7 +297,12 @@ export function isFileLoadingAllowed(`
`297`	`297`
`298`	`298`	`if(!fs.strict)returntrue`
`299`	`299`
`300`		`-if(config.fsDenyGlob(filePath))returnfalse`
	`300`	+// NOTE: `fs.readFile('/foo.png/')` tries to load `'/foo.png'`
	`301`	`+// so we should check the path without trailing slash`
	`302`	`+constfilePathWithoutTrailingSlash=filePath.endsWith('/')`
	`303`	`+ ?filePath.slice(0,-1)`
	`304`	`+ :filePath`
	`305`	`+if(config.fsDenyGlob(filePathWithoutTrailingSlash))returnfalse`
`301`	`306`
`302`	`307`	`if(config.safeModulePaths.has(filePath))returntrue`
`303`	`308`

Lines changed: 25 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,14 @@ import {`
`13`	`13`	`importtype{Page}from'playwright-chromium'`
`14`	`14`	`importWebSocketfrom'ws'`
`15`	`15`	`importtestJSONfrom'../safe.json'`
`16`		`-import{browser,isServe,page,viteServer,viteTestUrl}from'~utils'`
	`16`	`+import{`
	`17`	`+browser,`
	`18`	`+isServe,`
	`19`	`+isWindows,`
	`20`	`+page,`
	`21`	`+viteServer,`
	`22`	`+viteTestUrl,`
	`23`	`+}from'~utils'`
`17`	`24`
`18`	`25`	`const__dirname=path.dirname(fileURLToPath(import.meta.url))`
`19`	`26`
`@@ -538,6 +545,23 @@ describe.runIf(isServe)('invalid request', () => {`
`538`	`545`	`expect(response).toContain('HTTP/1.1 403 Forbidden')`
`539`	`546`	`})`
`540`	`547`
	`548`	`+test('should deny request to denied file when a request ends with \\',async()=>{`
	`549`	`+constresponse=awaitsendRawRequest(viteTestUrl,'/src/.env\\')`
	`550`	`+expect(response).toContain(`
	`551`	`+isWindows ?'HTTP/1.1 403 Forbidden' :'HTTP/1.1 404 Not Found',`
	`552`	`+)`
	`553`	`+})`
	`554`	`+`
	`555`	`+test('should deny request to denied file when a request ends with \\ with /@fs/',async()=>{`
	`556`	`+constresponse=awaitsendRawRequest(`
	`557`	`+viteTestUrl,`
	`558`	`+path.posix.join('/@fs/',root,'root/src/.env')+'\\',`
	`559`	`+)`
	`560`	`+expect(response).toContain(`
	`561`	`+isWindows ?'HTTP/1.1 403 Forbidden' :'HTTP/1.1 404 Not Found',`
	`562`	`+)`
	`563`	`+})`
	`564`	`+`
`541`	`565`	`test('should deny request with /@fs/ to denied file when a request has /.',async()=>{`
`542`	`566`	`constresponse=awaitsendRawRequest(`
`543`	`567`	`viteTestUrl,`

Comments

(0)