fix: stop considering parent URLs as public file (vitejs#11145)

futurGH · Feb 26, 2023 · 69dd986 · 69dd986
1 parent 970f5c0
commit 69dd986
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/packages/vite/src/node/plugins/asset.ts b/packages/vite/src/node/plugins/asset.ts
@@ -210,6 +210,10 @@ export function checkPublicFile(
     return
   }
   const publicFile = path.join(publicDir, cleanUrl(url))
+  if (!publicFile.startsWith(publicDir)) {
+    // can happen if URL starts with '../'
+    return
+  }
   if (fs.existsSync(publicFile)) {
     return publicFile
   } else {