Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: don't throw on malformed URLs #10901

Merged
merged 2 commits into from Nov 13, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 8 additions & 1 deletion packages/vite/src/node/__tests__/utils.spec.ts
Expand Up @@ -9,7 +9,8 @@ import {
isFileReadable,
isWindows,
posToNumber,
resolveHostname
resolveHostname,
shouldServe
} from '../utils'

describe('injectQuery', () => {
Expand Down Expand Up @@ -239,6 +240,12 @@ describe('asyncFlatten', () => {
})
})

describe('shouldServe', () => {
test('returns false for malformed URLs', () => {
expect(shouldServe('/%c0%ae%c0%ae/etc/passwd', '/assets/dir')).toBe(false)
})
})

describe('isFileReadable', () => {
test("file doesn't exist", async () => {
expect(isFileReadable('/does_not_exist')).toBe(false)
Expand Down
34 changes: 20 additions & 14 deletions packages/vite/src/node/utils.ts
Expand Up @@ -1198,22 +1198,28 @@ export const isNonDriveRelativeAbsolutePath = (p: string): boolean => {
* consistent behaviour between dev and prod and across operating systems.
*/
export function shouldServe(url: string, assetsDir: string): boolean {
// viteTestUrl is set to something like http://localhost:4173/ and then many tests make calls
// like `await page.goto(viteTestUrl + '/example')` giving us URLs beginning with a double slash
const pathname = decodeURI(
new URL(url.startsWith('//') ? url.substring(1) : url, 'http://example.com')
.pathname
)
const file = path.join(assetsDir, pathname)
if (
!fs.existsSync(file) ||
(isCaseInsensitiveFS && // can skip case check on Linux
!fs.statSync(file).isDirectory() &&
!hasCorrectCase(file, assetsDir))
) {
try {
// viteTestUrl is set to something like http://localhost:4173/ and then many tests make calls
// like `await page.goto(viteTestUrl + '/example')` giving us URLs beginning with a double slash
const pathname = decodeURI(
new URL(
url.startsWith('//') ? url.substring(1) : url,
'http://example.com'
).pathname
)
const file = path.join(assetsDir, pathname)
if (
!fs.existsSync(file) ||
(isCaseInsensitiveFS && // can skip case check on Linux
!fs.statSync(file).isDirectory() &&
!hasCorrectCase(file, assetsDir))
) {
return false
}
return true
} catch (err) {
return false
}
return true
}

/**
Expand Down