@bleedingdev/modern-js-server-core 3.5.0-ultramodern.30 → 3.5.0-ultramodern.31

package/dist/cjs/adapters/node/plugins/static.js

@@ -97,6 +97,10 @@ function createPublicMiddleware({ pwd, routes }) {
 function matchPublicRoute(req, routes) {
     for (const route of routes.sort(index_js_namespaceObject.sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
 }
+const isPathInside = (target, root)=>{
+    const relative = external_path_default().relative(external_path_default().resolve(root), external_path_default().resolve(target));
+    return '' === relative || !relative.startsWith(`..${external_path_default().sep}`) && '..' !== relative && !external_path_default().isAbsolute(relative);
+};
 const extractPathname = (url)=>{
     try {
         if (url.includes('://')) return new URL(url).pathname || '/';
@@ -176,6 +180,7 @@ function createStaticMiddleware(options) {
         const isModuleFederationAsset = moduleFederationAssetMeta.assets.has(requestPath);
         const isModuleFederationRemoteEntry = moduleFederationAssetMeta.remoteEntries.has(requestPath);
         const serveByPath = async (filepath, moduleFederationAsset = false, moduleFederationRemoteEntry = false)=>{
+            if (!isPathInside(filepath, pwd)) return null;
             if (!await utils_namespaceObject.fs.pathExists(filepath)) return null;
             return serveFile(c, filepath, moduleFederationAsset, moduleFederationRemoteEntry, requestPath);
         };

package/dist/esm/adapters/node/plugins/static.mjs

@@ -53,6 +53,10 @@ function createPublicMiddleware({ pwd, routes }) {
 function matchPublicRoute(req, routes) {
     for (const route of routes.sort(sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
 }
+const isPathInside = (target, root)=>{
+    const relative = path.relative(path.resolve(root), path.resolve(target));
+    return '' === relative || !relative.startsWith(`..${path.sep}`) && '..' !== relative && !path.isAbsolute(relative);
+};
 const extractPathname = (url)=>{
     try {
         if (url.includes('://')) return new URL(url).pathname || '/';
@@ -132,6 +136,7 @@ function createStaticMiddleware(options) {
         const isModuleFederationAsset = moduleFederationAssetMeta.assets.has(requestPath);
         const isModuleFederationRemoteEntry = moduleFederationAssetMeta.remoteEntries.has(requestPath);
         const serveByPath = async (filepath, moduleFederationAsset = false, moduleFederationRemoteEntry = false)=>{
+            if (!isPathInside(filepath, pwd)) return null;
             if (!await fs.pathExists(filepath)) return null;
             return serveFile(c, filepath, moduleFederationAsset, moduleFederationRemoteEntry, requestPath);
         };

package/dist/esm-node/adapters/node/plugins/static.mjs

@@ -54,6 +54,10 @@ function createPublicMiddleware({ pwd, routes }) {
 function matchPublicRoute(req, routes) {
     for (const route of routes.sort(sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
 }
+const isPathInside = (target, root)=>{
+    const relative = path.relative(path.resolve(root), path.resolve(target));
+    return '' === relative || !relative.startsWith(`..${path.sep}`) && '..' !== relative && !path.isAbsolute(relative);
+};
 const extractPathname = (url)=>{
     try {
         if (url.includes('://')) return new URL(url).pathname || '/';
@@ -133,6 +137,7 @@ function createStaticMiddleware(options) {
         const isModuleFederationAsset = moduleFederationAssetMeta.assets.has(requestPath);
         const isModuleFederationRemoteEntry = moduleFederationAssetMeta.remoteEntries.has(requestPath);
         const serveByPath = async (filepath, moduleFederationAsset = false, moduleFederationRemoteEntry = false)=>{
+            if (!isPathInside(filepath, pwd)) return null;
             if (!await fs.pathExists(filepath)) return null;
             return serveFile(c, filepath, moduleFederationAsset, moduleFederationRemoteEntry, requestPath);
         };

package/package.json

@@ -17,7 +17,7 @@
     "modern",
     "modern.js"
   ],
-  "version": "3.5.0-ultramodern.30",
+  "version": "3.5.0-ultramodern.31",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/cjs/index.js",
   "exports": {
@@ -76,9 +76,9 @@
     "flatted": "^3.4.2",
     "hono": "^4.12.27",
     "ts-deepmerge": "8.0.0",
-    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.5.0-ultramodern.30",
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.5.0-ultramodern.30",
-    "@modern-js/runtime-utils": "npm:@bleedingdev/modern-js-runtime-utils@3.5.0-ultramodern.30"
+    "@modern-js/runtime-utils": "npm:@bleedingdev/modern-js-runtime-utils@3.5.0-ultramodern.31",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.5.0-ultramodern.31",
+    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.5.0-ultramodern.31"
   },
   "devDependencies": {
     "@rslib/core": "0.23.1",
@@ -87,7 +87,7 @@
     "@types/node": "^26.0.1",
     "@typescript/native-preview": "7.0.0-dev.20260628.1",
     "http-proxy-middleware": "^4.1.1",
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.5.0-ultramodern.30",
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.5.0-ultramodern.31",
     "@scripts/rstest-config": "2.66.0"
   },
   "sideEffects": false,