Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: skip fs fallback for out of root urls, fix #3364 #3431

Merged
merged 1 commit into from May 17, 2021
Merged

fix: skip fs fallback for out of root urls, fix #3364 #3431

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 11 additions & 3 deletions packages/vite/src/node/server/middlewares/static.ts
View file
Open in desktop
Expand Up @@ -109,16 +109,24 @@ export function serveRawFsMiddleware(
}
}

export function isFileAccessAllowed(
url: string,
{ root, strict }: Required<FileSystemServeOptions>
): boolean {
return !strict || normalizePath(url).startsWith(root + path.posix.sep)
}

export function ensureServingAccess(
url: string,
{ root, strict }: Required<FileSystemServeOptions>,
serveOptions: Required<FileSystemServeOptions>,
logger: Logger
): void {
const { strict, root } = serveOptions
// TODO: early return, should remove once we polished the restriction logic
if (!strict) return

const normalizedUrl = normalizePath(url)
if (!normalizedUrl.startsWith(root + path.posix.sep)) {
if (!isFileAccessAllowed(url, serveOptions)) {
const normalizedUrl = normalizePath(url)
if (strict) {
throw new AccessRestrictedError(
`The request url "${normalizedUrl}" is outside of vite dev server root "${root}".
Expand Down
21 changes: 11 additions & 10 deletions packages/vite/src/node/server/transformRequest.ts
View file
Open in desktop
Expand Up @@ -16,7 +16,7 @@ import {
import { checkPublicFile } from '../plugins/asset'
import { ssrTransform } from '../ssr/ssrTransform'
import { injectSourcesContent } from './sourcemap'
import { ensureServingAccess } from './middlewares/static'
import { isFileAccessAllowed } from './middlewares/static'

const debugLoad = createDebugger('vite:load')
const debugTransform = createDebugger('vite:transform')
Expand Down Expand Up @@ -73,15 +73,16 @@ export async function transformRequest(
// try fallback loading it from fs as string
// if the file is a binary, there should be a plugin that already loaded it
// as string
try {
if (!options.ssr) {
ensureServingAccess(file, config.server.fsServe, config.logger)
}
code = await fs.readFile(file, 'utf-8')
isDebug && debugLoad(`${timeFrom(loadStart)} [fs] ${prettyUrl}`)
} catch (e) {
if (e.code !== 'ENOENT') {
throw e
// only try the fallback if access is allowed, skip for out of root url
// like /service-worker.js or /api/users
if (options.ssr || isFileAccessAllowed(file, config.server.fsServe)) {
try {
code = await fs.readFile(file, 'utf-8')
isDebug && debugLoad(`${timeFrom(loadStart)} [fs] ${prettyUrl}`)
} catch (e) {
if (e.code !== 'ENOENT') {
throw e
}
}
}
if (code) {
Expand Down