Vue/vite
1
0
Fork 0
mirror of https://github.com/vitejs/vite.git synced 2024-11-21 22:59:10 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

fix: fs deny for case insensitive systems (#15653)

Browse Source
This commit is contained in:
patak 2024-01-19 14:02:51 +01:00
parent c0751156f0
commit eeec23bbc9
4 changed files with 33 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
packages/vite/src/node/server/index.ts
View File

@ -509,7 +509,10 @@ export async function _createServer(
_importGlobMap: new Map(),
_forceOptimizeOnRestart: false,
_pendingRequests: new Map(),
_fsDenyGlob: picomatch(config.server.fs.deny, { matchBase: true }),
_fsDenyGlob: picomatch(config.server.fs.deny, {
matchBase: true,
nocase: true,
}),
_shortcutsOptions: undefined,
}

8
playground/fs-serve/__tests__/base/fs-serve-base.spec.ts
View File

@ -92,7 +92,13 @@ describe.runIf(isServe)('main', () => {
})
test('denied', async () => {
expect(await page.textContent('.unsafe-dotenv')).toBe('404')
expect(await page.textContent('.unsafe-dotenv')).toBe('403')
})
test('denied EnV casing', async () => {
// It is 403 in case insensitive system, 404 in others
const code = await page.textContent('.unsafe-dotEnV-casing')
expect(code === '403' || code === '404').toBeTruthy()
})
})

8
playground/fs-serve/__tests__/fs-serve.spec.ts
View File

@ -92,7 +92,13 @@ describe.runIf(isServe)('main', () => {
})
test('denied', async () => {
expect(await page.textContent('.unsafe-dotenv')).toBe('404')
expect(await page.textContent('.unsafe-dotenv')).toBe('403')
})
test('denied EnV casing', async () => {
// It is 403 in case insensitive system, 404 in others
const code = await page.textContent('.unsafe-dotEnV-casing')
expect(code === '403' || code === '404').toBeTruthy()
})
})

16
playground/fs-serve/root/src/index.html
View File

@ -45,6 +45,7 @@
<h2>Denied</h2>
<pre class="unsafe-dotenv"></pre>
<pre class="unsafe-dotEnV-casing"></pre>
<script type="module">
import '../../entry'
@ -236,7 +237,9 @@
})
// .env, denied by default
fetch(joinUrlSegments(base, joinUrlSegments('/@fs/', ROOT) + '/root/.env'))
fetch(
joinUrlSegments(base, joinUrlSegments('/@fs/', ROOT) + '/root/src/.env'),
)
.then((r) => {
text('.unsafe-dotenv', r.status)
})
@ -244,6 +247,17 @@
console.error(e)
})
// .env, for case insensitive file systems
fetch(
joinUrlSegments(base, joinUrlSegments('/@fs/', ROOT) + '/root/src/.EnV'),
)
.then((r) => {
text('.unsafe-dotEnV-casing', r.status)
})
.catch((e) => {
console.error(e)
})
function text(sel, text) {
document.querySelector(sel).textContent = text
}