fix: restrict static middleware fs access

[patak-dev]

Description

Fix #5345

This PR modifies the fs-serve playground so the allowed folder is not the same as the root, so we can also test the static middleware file access.

@antfu there are two TODO: in the code:

 // TODO: should use ensureServingAccess(fileUrl, server)
 if (!isFileServingAllowed(fileUrl, server)) {
   return next()
 }

We should use ensureServingAccess so an AccessRestrictedError is thrown and catched later to respond with a 403, but when I tried this the program was terminating unexpectedly and I couldn't figure out why. The current code is skipping the url if it isn't allowed, so the response is a 404. We could evaluate merging as is, since this is a security vulnerability. And improve later, but maybe you see what I missed.

Maybe it isn't a bad idea to enqueue this change for the 2.7 beta if we are going to start the process soon.

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

[benmccann]

Thank you so much for this fix!

As a higher-level note, having both the public and static middlewares means every public file is accessible via two different URLs, which isn't necessarily desirable. I wonder if it would be good to try to have just a single middleware for statically serving files. (This is all assuming the public directory lives within the project workspace, which is true for SvelteKit, but I'm not sure about Vite projects generally)

[antfu]

Guess we could release this as a part of 2.6 before we flip the default in 2.7

[AlbertMarashi]

@antfu sooner the better.