@modern-js/server-core 3.5.0 → 3.7.0

package/dist/cjs/adapters/node/plugins/static.js

@@ -91,6 +91,10 @@ function createPublicMiddleware({ pwd, routes }) {
 function matchPublicRoute(req, routes) {
     for (const route of routes.sort(index_js_namespaceObject.sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
 }
+const isPathInside = (target, root)=>{
+    const relative = external_path_default().relative(external_path_default().resolve(root), external_path_default().resolve(target));
+    return '' === relative || !relative.startsWith(`..${external_path_default().sep}`) && '..' !== relative && !external_path_default().isAbsolute(relative);
+};
 const extractPathname = (url)=>{
     try {
         if (url.includes('://')) return new URL(url).pathname || '/';
@@ -141,6 +145,7 @@ function createStaticMiddleware(options) {
         })(c, next);
         {
             const filepath = external_path_default().join(pwd, pathname.replace(pathPrefix, ()=>''));
+            if (!isPathInside(filepath, pwd)) return next();
             if (!await utils_namespaceObject.fs.pathExists(filepath)) return next();
             const mimeType = (0, mime_namespaceObject.getMimeType)(filepath);
             if (mimeType) c.header('Content-Type', mimeType);

package/dist/esm/adapters/node/plugins/static.mjs

@@ -47,6 +47,10 @@ function createPublicMiddleware({ pwd, routes }) {
 function matchPublicRoute(req, routes) {
     for (const route of routes.sort(sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
 }
+const isPathInside = (target, root)=>{
+    const relative = path.relative(path.resolve(root), path.resolve(target));
+    return '' === relative || !relative.startsWith(`..${path.sep}`) && '..' !== relative && !path.isAbsolute(relative);
+};
 const extractPathname = (url)=>{
     try {
         if (url.includes('://')) return new URL(url).pathname || '/';
@@ -97,6 +101,7 @@ function createStaticMiddleware(options) {
         })(c, next);
         {
             const filepath = path.join(pwd, pathname.replace(pathPrefix, ()=>''));
+            if (!isPathInside(filepath, pwd)) return next();
             if (!await fs.pathExists(filepath)) return next();
             const mimeType = getMimeType(filepath);
             if (mimeType) c.header('Content-Type', mimeType);

package/dist/esm/plugins/render/render.mjs

@@ -10,7 +10,7 @@ import { ssrRender } from "./ssrRender.mjs";
 import { __webpack_require__ } from "../../rslib-runtime.mjs";
 import * as __rspack_external__modern_js_runtime_utils_router_2aa8d96f from "@modern-js/runtime-utils/router";
 __webpack_require__.add({
-    2420 (module) {
+    5327 (module) {
         module.exports = __rspack_external__modern_js_runtime_utils_router_2aa8d96f;
     }
 });
@@ -149,7 +149,7 @@ async function renderHandler(request, options, mode, fallbackWrapper, framework)
         const { nestedRoutesJson } = serverManifest;
         const routes = nestedRoutesJson?.[options.routeInfo.entryName];
         if (routes) {
-            const { matchRoutes } = __webpack_require__(2420);
+            const { matchRoutes } = __webpack_require__(5327);
             const url = new URL(request.url);
             const matchedRoutes = matchRoutes(routes, url.pathname, options.routeInfo.urlPath);
             if (matchedRoutes) {

package/dist/esm-node/adapters/node/plugins/static.mjs

@@ -48,6 +48,10 @@ function createPublicMiddleware({ pwd, routes }) {
 function matchPublicRoute(req, routes) {
     for (const route of routes.sort(sortRoutes))if (!route.isSSR && route.entryPath.startsWith('public') && req.path.startsWith(route.urlPath)) return route;
 }
+const isPathInside = (target, root)=>{
+    const relative = path.relative(path.resolve(root), path.resolve(target));
+    return '' === relative || !relative.startsWith(`..${path.sep}`) && '..' !== relative && !path.isAbsolute(relative);
+};
 const extractPathname = (url)=>{
     try {
         if (url.includes('://')) return new URL(url).pathname || '/';
@@ -98,6 +102,7 @@ function createStaticMiddleware(options) {
         })(c, next);
         {
             const filepath = path.join(pwd, pathname.replace(pathPrefix, ()=>''));
+            if (!isPathInside(filepath, pwd)) return next();
             if (!await fs.pathExists(filepath)) return next();
             const mimeType = getMimeType(filepath);
             if (mimeType) c.header('Content-Type', mimeType);

package/package.json

@@ -15,7 +15,7 @@
     "modern",
     "modern.js"
   ],
-  "version": "3.5.0",
+  "version": "3.7.0",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/cjs/index.js",
   "exports": {
@@ -71,20 +71,20 @@
     "flatted": "^3.4.2",
     "hono": "^4.11.7",
     "ts-deepmerge": "7.0.3",
-    "@modern-js/plugin": "3.5.0",
-    "@modern-js/runtime-utils": "3.5.0",
-    "@modern-js/utils": "3.5.0"
+    "@modern-js/plugin": "3.7.0",
+    "@modern-js/runtime-utils": "3.7.0",
+    "@modern-js/utils": "3.7.0"
   },
   "devDependencies": {
-    "@rslib/core": "0.23.0",
+    "@rslib/core": "0.23.2",
     "@types/cloneable-readable": "^2.0.3",
     "@types/merge-deep": "^3.0.3",
     "@types/node": "^20",
-    "http-proxy-middleware": "^2.0.9",
+    "http-proxy-middleware": "^2.0.10",
     "typescript": "^5",
+    "@scripts/rstest-config": "2.66.0",
     "@modern-js/rslib": "2.68.10",
-    "@modern-js/types": "3.5.0",
-    "@scripts/rstest-config": "2.66.0"
+    "@modern-js/types": "3.7.0"
   },
   "sideEffects": false,
   "publishConfig": {