fix: ensure working

vitejs · Oct 22, 2021 · 4afa16d · 4afa16d
1 parent e1f47b9
commit 4afa16d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 10 deletions.
diff --git a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
@@ -24,8 +24,8 @@ describe('main', () => {
     })
 
     test('unsafe fetch', async () => {
-      expect(await page.textContent('.unsafe-fetch')).toBe('')
-      expect(await page.textContent('.unsafe-fetch-status')).toBe('404') // TODO: should be 403
+      expect(await page.textContent('.unsafe-fetch')).toMatch('403 Restricted')
+      expect(await page.textContent('.unsafe-fetch-status')).toBe('403')
     })
 
     test('safe fs fetch', async () => {

diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts
@@ -82,15 +82,12 @@ export function serveStaticMiddleware(
     }
 
     const resolvedUrl = redirected || url
-    const fileUrl = path.resolve(
-      dir,
-      resolvedUrl.startsWith('/') ? resolvedUrl.slice(1) : resolvedUrl
-    )
-    // TODO: should use ensureServingAccess(fileUrl, server), so we get a 403
-    if (!isFileServingAllowed(fileUrl, server)) {
-      return next()
+    let fileUrl = path.resolve(dir, resolvedUrl.replace(/^\//, ''))
+    if (resolvedUrl.endsWith('/') && !fileUrl.endsWith('/')) {
+      fileUrl = fileUrl + '/'
     }
-
+    ensureServingAccess(fileUrl, server)
+
     if (redirected) {
       req.url = redirected
     }