From fa86b17600ece582b41abc2d3125afba9fd7f0b9 Mon Sep 17 00:00:00 2001
From: Anthony Fu <anthonyfu117@hotmail.com>
Date: Fri, 22 Oct 2021 06:05:17 +0800
Subject: [PATCH 1/4] feat: `server.fs.deny` support

---
 docs/config/index.md                          |  9 ++++++++
 .../fs-serve/__tests__/fs-serve.spec.ts       |  9 ++++++++
 .../playground/fs-serve/root/src/index.html   | 22 +++++++++++++++++++
 packages/vite/src/node/server/index.ts        | 16 +++++++++++++-
 .../src/node/server/middlewares/static.ts     |  6 +++++
 packages/vite/types/shims.d.ts                |  6 ++++-
 6 files changed, 66 insertions(+), 2 deletions(-)

diff --git a/docs/config/index.md b/docs/config/index.md
index 6bb9836e69094d..82519221acee4d 100644
--- a/docs/config/index.md
+++ b/docs/config/index.md
@@ -593,6 +593,15 @@ createServer()
   })
   ```
 
+### server.fs.deny
+
+- **Experimental**
+- **Type:** `string[]`
+
+  Blocklist for sensitive files being restricted to be served by Vite dev server.
+
+  Default to `['.env', '.env.*', '*.{pem,crt}']`.
+
 ### server.origin
 
 - **Type:** `string`
diff --git a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
index c3d8ee9a9bf911..263bcabad5e41f 100644
--- a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
+++ b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
@@ -41,6 +41,15 @@ describe('main', () => {
     test('nested entry', async () => {
       expect(await page.textContent('.nested-entry')).toBe('foobar')
     })
+
+    test('nested entry', async () => {
+      expect(await page.textContent('.nested-entry')).toBe('foobar')
+    })
+  
+    test('denied', async () => {
+      expect(await page.textContent('.unsafe-dotenv')).toBe('403')
+      expect(await page.textContent('.safe-root-file')).toBe('200')
+    })
   } else {
     test('dummy test to make jest happy', async () => {
       // Your test suite must contain at least one test.
diff --git a/packages/playground/fs-serve/root/src/index.html b/packages/playground/fs-serve/root/src/index.html
index 67a2371c6b27fb..b1e93e292d12eb 100644
--- a/packages/playground/fs-serve/root/src/index.html
+++ b/packages/playground/fs-serve/root/src/index.html
@@ -23,6 +23,10 @@ <h2>Unsafe /@fs/ Fetch</h2>
 <h2>Nested Entry</h2>
 <pre class="nested-entry"></pre>
 
+<h2>Denied</h2>
+<pre class="unsafe-dotenv"></pre>
+<pre class="safe-root-file"></pre>
+
 <script type="module">
   import '../../entry'
   import json, { msg } from '../../safe.json'
@@ -76,6 +80,24 @@ <h2>Nested Entry</h2>
       console.error(e)
     })
 
+  // .env, denied by default
+  fetch('/@fs/' + ROOT + '/root/.env')
+    .then((r) => {
+      text('.unsafe-dotenv', r.status)
+    })
+    .catch((e) => {
+      console.error(e)
+    })
+
+  // other files under the root, ok
+  fetch('/@fs/' + ROOT + '/root/vite.config.js')
+    .then((r) => {
+      text('.safe-root-file', r.status)
+    })
+    .catch((e) => {
+      console.error(e)
+    })
+
   function text(sel, text) {
     document.querySelector(sel).textContent = text
   }
diff --git a/packages/vite/src/node/server/index.ts b/packages/vite/src/node/server/index.ts
index 42a1b1b5601bdb..7a3ad551fbc7d6 100644
--- a/packages/vite/src/node/server/index.ts
+++ b/packages/vite/src/node/server/index.ts
@@ -162,6 +162,18 @@ export interface FileSystemServeOptions {
    * @experimental
    */
   allow?: string[]
+
+  /**
+   * Restrict accessing files that matches the patterns.
+   *
+   * This will have higher priority than `allow`.
+   * Glob patterns are supported.
+   *
+   * @default ['.env', '.env.*', '*.crt', '*.pem']
+   *
+   * @experimental
+   */
+  deny?: string[]
 }
 
 /**
@@ -690,6 +702,7 @@ export function resolveServerOptions(
 ): ResolvedServerOptions {
   const server = raw || {}
   let allowDirs = server.fs?.allow
+  const deny = server.fs?.deny || ['.env', '.env.*', '*.{crt,pem}']
 
   if (!allowDirs) {
     allowDirs = [searchForWorkspaceRoot(root)]
@@ -706,7 +719,8 @@ export function resolveServerOptions(
   server.fs = {
     // TODO: make strict by default
     strict: server.fs?.strict,
-    allow: allowDirs
+    allow: allowDirs,
+    deny
   }
   return server as ResolvedServerOptions
 }
diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts
index 4132b0d39fe3a3..a8b8f201a474d5 100644
--- a/packages/vite/src/node/server/middlewares/static.ts
+++ b/packages/vite/src/node/server/middlewares/static.ts
@@ -12,6 +12,7 @@ import {
   isWindows,
   slash
 } from '../../utils'
+import match from 'minimatch'
 import { AccessRestrictedError } from './error'
 
 const sirvOptions: Options = {
@@ -122,6 +123,8 @@ export function serveRawFsMiddleware(
   }
 }
 
+const _matchOptions = { matchBase: true }
+
 export function isFileServingAllowed(
   url: string,
   server: ViteDevServer
@@ -131,6 +134,9 @@ export function isFileServingAllowed(
 
   const file = ensureLeadingSlash(normalizePath(cleanUrl(url)))
 
+  if (server.config.server.fs.deny.some((i) => match(file, i, _matchOptions)))
+    return false
+
   if (server.moduleGraph.safeModulesPath.has(file)) return true
 
   if (server.config.server.fs.allow.some((i) => file.startsWith(i + '/')))
diff --git a/packages/vite/types/shims.d.ts b/packages/vite/types/shims.d.ts
index 80a251b3f3b704..a351f6bfc81092 100644
--- a/packages/vite/types/shims.d.ts
+++ b/packages/vite/types/shims.d.ts
@@ -96,7 +96,11 @@ declare module 'rollup-plugin-web-worker-loader' {
 }
 
 declare module 'minimatch' {
-  function match(path: string, pattern: string): boolean
+  function match(
+    path: string,
+    pattern: string,
+    options?: { matchBase?: boolean }
+  ): boolean
   export default match
 }
 

From 2d3135e7c1055a530dd95d94011ce53a510fae4e Mon Sep 17 00:00:00 2001
From: Anthony Fu <anthonyfu117@hotmail.com>
Date: Mon, 25 Oct 2021 00:31:15 +0800
Subject: [PATCH 2/4] chore: fix test

---
 packages/playground/fs-serve/root/src/.env             | 2 +-
 packages/playground/fs-serve/root/src/index.html       | 6 +++---
 packages/playground/fs-serve/root/src/safe.txt         | 1 +
 packages/playground/fs-serve/root/{.env => unsafe.txt} | 0
 4 files changed, 5 insertions(+), 4 deletions(-)
 create mode 100644 packages/playground/fs-serve/root/src/safe.txt
 rename packages/playground/fs-serve/root/{.env => unsafe.txt} (100%)

diff --git a/packages/playground/fs-serve/root/src/.env b/packages/playground/fs-serve/root/src/.env
index 3f3d0607101642..d0e0cfd28cbe57 100644
--- a/packages/playground/fs-serve/root/src/.env
+++ b/packages/playground/fs-serve/root/src/.env
@@ -1 +1 @@
-KEY=safe
+KEY=unsafe
diff --git a/packages/playground/fs-serve/root/src/index.html b/packages/playground/fs-serve/root/src/index.html
index b1e93e292d12eb..b2b26c790ec027 100644
--- a/packages/playground/fs-serve/root/src/index.html
+++ b/packages/playground/fs-serve/root/src/index.html
@@ -35,7 +35,7 @@ <h2>Denied</h2>
   text('.named', msg)
 
   // inside allowed dir, safe fetch
-  fetch('/src/.env')
+  fetch('/src/safe.txt')
     .then((r) => {
       text('.safe-fetch-status', r.status)
       return r.text()
@@ -45,7 +45,7 @@ <h2>Denied</h2>
     })
 
   // outside of allowed dir, treated as unsafe
-  fetch('/.env')
+  fetch('/unsafe.txt')
     .then((r) => {
       text('.unsafe-fetch-status', r.status)
       return r.text()
@@ -101,4 +101,4 @@ <h2>Denied</h2>
   function text(sel, text) {
     document.querySelector(sel).textContent = text
   }
-</script>
\ No newline at end of file
+</script>
diff --git a/packages/playground/fs-serve/root/src/safe.txt b/packages/playground/fs-serve/root/src/safe.txt
new file mode 100644
index 00000000000000..3f3d0607101642
--- /dev/null
+++ b/packages/playground/fs-serve/root/src/safe.txt
@@ -0,0 +1 @@
+KEY=safe
diff --git a/packages/playground/fs-serve/root/.env b/packages/playground/fs-serve/root/unsafe.txt
similarity index 100%
rename from packages/playground/fs-serve/root/.env
rename to packages/playground/fs-serve/root/unsafe.txt

From 946cfa2e4cd9e5c74e9125496c28bb6de0a11a3f Mon Sep 17 00:00:00 2001
From: Anthony Fu <anthonyfu117@hotmail.com>
Date: Mon, 25 Oct 2021 01:07:37 +0800
Subject: [PATCH 3/4] chore: update

---
 .../playground/fs-serve/__tests__/fs-serve.spec.ts     |  3 +--
 packages/playground/fs-serve/root/src/index.html       | 10 ----------
 2 files changed, 1 insertion(+), 12 deletions(-)

diff --git a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
index 263bcabad5e41f..2a110a4ae2305e 100644
--- a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
+++ b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
@@ -45,10 +45,9 @@ describe('main', () => {
     test('nested entry', async () => {
       expect(await page.textContent('.nested-entry')).toBe('foobar')
     })
-  
+
     test('denied', async () => {
       expect(await page.textContent('.unsafe-dotenv')).toBe('403')
-      expect(await page.textContent('.safe-root-file')).toBe('200')
     })
   } else {
     test('dummy test to make jest happy', async () => {
diff --git a/packages/playground/fs-serve/root/src/index.html b/packages/playground/fs-serve/root/src/index.html
index b2b26c790ec027..c8b294e86ab0ea 100644
--- a/packages/playground/fs-serve/root/src/index.html
+++ b/packages/playground/fs-serve/root/src/index.html
@@ -25,7 +25,6 @@ <h2>Nested Entry</h2>
 
 <h2>Denied</h2>
 <pre class="unsafe-dotenv"></pre>
-<pre class="safe-root-file"></pre>
 
 <script type="module">
   import '../../entry'
@@ -89,15 +88,6 @@ <h2>Denied</h2>
       console.error(e)
     })
 
-  // other files under the root, ok
-  fetch('/@fs/' + ROOT + '/root/vite.config.js')
-    .then((r) => {
-      text('.safe-root-file', r.status)
-    })
-    .catch((e) => {
-      console.error(e)
-    })
-
   function text(sel, text) {
     document.querySelector(sel).textContent = text
   }

From fec3ad1adb2b3ee3a68f6b7c1e6430b558498dea Mon Sep 17 00:00:00 2001
From: Anthony Fu <anthonyfu117@hotmail.com>
Date: Wed, 27 Oct 2021 22:11:49 +0800
Subject: [PATCH 4/4] Update
 packages/playground/fs-serve/__tests__/fs-serve.spec.ts

---
 packages/playground/fs-serve/__tests__/fs-serve.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
index 2a110a4ae2305e..c618186b9bcd64 100644
--- a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
+++ b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
@@ -47,7 +47,7 @@ describe('main', () => {
     })
 
     test('denied', async () => {
-      expect(await page.textContent('.unsafe-dotenv')).toBe('403')
+      expect(await page.textContent('.unsafe-dotenv')).toBe('404')
     })
   } else {
     test('dummy test to make jest happy', async () => {