Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: allowed files logic (fix #5416) #5420

Merged
merged 9 commits into from Oct 26, 2021
Merged

fix: allowed files logic (fix #5416) #5420

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
69be522
fix: allowed files logic (fix #5416)
patak-dev Oct 25, 2021
1daa39d
chore: spacing
patak-dev Oct 25, 2021
3434e40
fix: move error message to ensure
patak-dev Oct 25, 2021
45a4c42
refactor: revert to 403
patak-dev Oct 25, 2021
978e9ab
refactor: isFileReadable
patak-dev Oct 26, 2021
73b01cc
chore: simplify isFileReadable
patak-dev Oct 26, 2021
1638e61
chore: format
patak-dev Oct 26, 2021
9c0afa9
fix: use cleanUrl when strict false, allow info once
patak-dev Oct 26, 2021
77193ec
chore: typing
patak-dev Oct 26, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 3 additions & 3 deletions packages/playground/fs-serve/__tests__/fs-serve.spec.ts
View file
Open in desktop
Expand Up @@ -24,8 +24,8 @@ describe('main', () => {
})

test('unsafe fetch', async () => {
expect(await page.textContent('.unsafe-fetch')).toMatch('')
expect(await page.textContent('.unsafe-fetch-status')).toBe('404')
expect(await page.textContent('.unsafe-fetch')).toMatch('403 Restricted')
expect(await page.textContent('.unsafe-fetch-status')).toBe('403')
})

test('safe fs fetch', async () => {
Expand All @@ -35,7 +35,7 @@ describe('main', () => {

test('unsafe fs fetch', async () => {
expect(await page.textContent('.unsafe-fs-fetch')).toBe('')
expect(await page.textContent('.unsafe-fs-fetch-status')).toBe('404')
expect(await page.textContent('.unsafe-fs-fetch-status')).toBe('403')
})

test('nested entry', async () => {
Expand Down
27 changes: 22 additions & 5 deletions packages/vite/src/node/server/middlewares/static.ts
View file
Open in desktop
Expand Up @@ -161,21 +161,22 @@ export function isFileServingAllowed(
function ensureServingAccess(
url: string,
server: ViteDevServer,
res: ServerResponse,
res: ServerResponse,
next: Connect.NextFunction,
): boolean {
if (isFileServingAllowed(url, server)) {
return true
}
if (fs.existsSync(url)) {
patak-dev marked this conversation as resolved.
Show resolved Hide resolved
server.config.logger.error(
`The request url "${url}" is outside of Vite serving allow list:
const message = `The request url "${url}" is outside of Vite serving allow list:

${server.config.server.fs.allow.map((i) => `- ${i}`).join('\n')}

Refer to docs https://vitejs.dev/config/#server-fs-allow for configurations and more details.`
)
res.statusCode = 404

server.config.logger.error(message + '\n')
res.statusCode = 403
res.write(renderRestrictedErrorHTML(message))
res.end()
}
else {
Expand All @@ -185,3 +186,19 @@ Refer to docs https://vitejs.dev/config/#server-fs-allow for configurations and
}
return false
}

function renderRestrictedErrorHTML(msg: string): string {
// to have syntax highlighting and autocompletion in IDE
const html = String.raw
return html`
<body>
<h1>403 Restricted</h1>
<p>${msg.replace(/\n/g, '<br/>')}</p>
<style>
body {
padding: 1em 2em;
}
</style>
</body>
`
}