@@ -13,7 +13,7 @@ import {
1313 isImportRequest ,
1414 isInternalRequest ,
1515 isParentDirectory ,
16- isSameFileUri ,
16+ isSameFilePath ,
1717 normalizePath ,
1818 removeLeadingSlash ,
1919 urlRE ,
@@ -262,10 +262,22 @@ export function isFileServingAllowed(
262262 return isFileLoadingAllowed ( config , filePath )
263263}
264264
265- function isUriInFilePath ( uri : string , filePath : string ) {
266- return isSameFileUri ( uri , filePath ) || isParentDirectory ( uri , filePath )
265+ /**
266+ * Warning: parameters are not validated, only works with normalized absolute paths
267+ *
268+ * @param targetPath - normalized absolute path
269+ * @param filePath - normalized absolute path
270+ */
271+ function isFileInTargetPath ( targetPath : string , filePath : string ) {
272+ return (
273+ isSameFilePath ( targetPath , filePath ) ||
274+ isParentDirectory ( targetPath , filePath )
275+ )
267276}
268277
278+ /**
279+ * Warning: parameters are not validated, only works with normalized absolute paths
280+ */
269281export function isFileLoadingAllowed (
270282 config : ResolvedConfig ,
271283 filePath : string ,
@@ -278,7 +290,7 @@ export function isFileLoadingAllowed(
278290
279291 if ( config . safeModulePaths . has ( filePath ) ) return true
280292
281- if ( fs . allow . some ( ( uri ) => isUriInFilePath ( uri , filePath ) ) ) return true
293+ if ( fs . allow . some ( ( uri ) => isFileInTargetPath ( uri , filePath ) ) ) return true
282294
283295 return false
284296}
@@ -298,27 +310,12 @@ export function checkLoadingAccess(
298310 return 'fallback'
299311}
300312
301- export function checkServingAccess (
302- url : string ,
303- server : ViteDevServer ,
304- ) : 'allowed' | 'denied' | 'fallback' {
305- if ( isFileServingAllowed ( url , server ) ) {
306- return 'allowed'
307- }
308- if ( isFileReadable ( cleanUrl ( url ) ) ) {
309- return 'denied'
310- }
311- // if the file doesn't exist, we shouldn't restrict this path as it can
312- // be an API call. Middlewares would issue a 404 if the file isn't handled
313- return 'fallback'
314- }
315-
316313export function respondWithAccessDenied (
317- url : string ,
314+ id : string ,
318315 server : ViteDevServer ,
319316 res : ServerResponse ,
320317) : void {
321- const urlMessage = `The request url "${ url } " is outside of Vite serving allow list.`
318+ const urlMessage = `The request id "${ id } " is outside of Vite serving allow list.`
322319 const hintMessage = `
323320${ server . config . server . fs . allow . map ( ( i ) => `- ${ i } ` ) . join ( '\n' ) }
324321
0 commit comments