@@ -13,7 +13,7 @@ import {
13
13
isImportRequest ,
14
14
isInternalRequest ,
15
15
isParentDirectory ,
16
- isSameFileUri ,
16
+ isSameFilePath ,
17
17
normalizePath ,
18
18
removeLeadingSlash ,
19
19
urlRE ,
@@ -262,10 +262,22 @@ export function isFileServingAllowed(
262
262
return isFileLoadingAllowed ( config , filePath )
263
263
}
264
264
265
- function isUriInFilePath ( uri : string , filePath : string ) {
266
- return isSameFileUri ( uri , filePath ) || isParentDirectory ( uri , filePath )
265
+ /**
266
+ * Warning: parameters are not validated, only works with normalized absolute paths
267
+ *
268
+ * @param targetPath - normalized absolute path
269
+ * @param filePath - normalized absolute path
270
+ */
271
+ function isFileInTargetPath ( targetPath : string , filePath : string ) {
272
+ return (
273
+ isSameFilePath ( targetPath , filePath ) ||
274
+ isParentDirectory ( targetPath , filePath )
275
+ )
267
276
}
268
277
278
+ /**
279
+ * Warning: parameters are not validated, only works with normalized absolute paths
280
+ */
269
281
export function isFileLoadingAllowed (
270
282
config : ResolvedConfig ,
271
283
filePath : string ,
@@ -278,7 +290,7 @@ export function isFileLoadingAllowed(
278
290
279
291
if ( config . safeModulePaths . has ( filePath ) ) return true
280
292
281
- if ( fs . allow . some ( ( uri ) => isUriInFilePath ( uri , filePath ) ) ) return true
293
+ if ( fs . allow . some ( ( uri ) => isFileInTargetPath ( uri , filePath ) ) ) return true
282
294
283
295
return false
284
296
}
@@ -298,27 +310,12 @@ export function checkLoadingAccess(
298
310
return 'fallback'
299
311
}
300
312
301
- export function checkServingAccess (
302
- url : string ,
303
- server : ViteDevServer ,
304
- ) : 'allowed' | 'denied' | 'fallback' {
305
- if ( isFileServingAllowed ( url , server ) ) {
306
- return 'allowed'
307
- }
308
- if ( isFileReadable ( cleanUrl ( url ) ) ) {
309
- return 'denied'
310
- }
311
- // if the file doesn't exist, we shouldn't restrict this path as it can
312
- // be an API call. Middlewares would issue a 404 if the file isn't handled
313
- return 'fallback'
314
- }
315
-
316
313
export function respondWithAccessDenied (
317
- url : string ,
314
+ id : string ,
318
315
server : ViteDevServer ,
319
316
res : ServerResponse ,
320
317
) : void {
321
- const urlMessage = `The request url "${ url } " is outside of Vite serving allow list.`
318
+ const urlMessage = `The request id "${ id } " is outside of Vite serving allow list.`
322
319
const hintMessage = `
323
320
${ server . config . server . fs . allow . map ( ( i ) => `- ${ i } ` ) . join ( '\n' ) }
324
321
0 commit comments