@rsbuild/core 2.2.2 → 2.2.3

package/dist/626.js

@@ -3425,7 +3425,7 @@ function createPublicContext(context) {
 async function createContext(options, userConfig, logger, loadConfigResult) {
     let { cwd } = options, rootPath = userConfig.root ? ensureAbsolutePath(cwd, userConfig.root) : cwd, rsbuildConfig = await withDefaultConfig(rootPath, userConfig), cachePath = join(rootPath, 'node_modules', '.cache'), specifiedEnvironments = options.environment && options.environment.length > 0 ? options.environment : void 0, hooks = initHooks();
     return {
-        version: "2.2.2",
+        version: "2.2.3",
         rootPath,
         configFile: loadConfigResult?.filePath ?? userConfig._privateMeta?.configFilePath,
         configFileDependencies: loadConfigResult?.dependencies ?? userConfig._privateMeta?.configFileDependencies ?? [],
@@ -6593,13 +6593,23 @@ async function getFileFromUrl(url, outputFileSystem, context) {
     if (pathname.includes('\0')) return {
         errorCode: 400
     };
-    if (UP_PATH_REGEXP.test(node_path.normalize(`./${pathname}`))) return {
+    let hasUpPath = UP_PATH_REGEXP.test(pathname);
+    if (hasUpPath && UP_PATH_REGEXP.test(node_path.normalize(`./${pathname}`))) return {
         errorCode: 403
     };
     let { environmentList, publicPathnames } = context, distPaths = environmentList.map((env)=>env.distPath), possibleFilenames = new Set();
     for (let [index, distPath] of distPaths.entries()){
         let prefix = publicPathnames[index];
-        prefix && '/' !== prefix && isUrlPathUnderBase(pathname, prefix) && possibleFilenames.add(node_path.join(distPath, pathname.slice(prefix.length)));
+        if (prefix && '/' !== prefix && isUrlPathUnderBase(pathname, prefix)) {
+            let candidatePath = node_path.join(distPath, pathname.slice(prefix.length));
+            if (hasUpPath) {
+                let relativePath = node_path.relative(distPath, candidatePath);
+                if (UP_PATH_REGEXP.test(relativePath)) return {
+                    errorCode: 403
+                };
+            }
+            possibleFilenames.add(candidatePath);
+        }
     }
     for (let distPath of distPaths)possibleFilenames.add(node_path.join(distPath, pathname));
     for (let filename of possibleFilenames){
@@ -6783,8 +6793,13 @@ function sendError(res, code) {
     let byteLength = Buffer.byteLength(document);
     res.setHeader('Content-Length', byteLength), res.end(document);
 }
+let filterWebEnvironments = (environmentList)=>environmentList.filter((environment)=>isWebTarget(environment.config.output.target));
 function createAssetsMiddleware(context, ready, outputFileSystem) {
-    let { logger } = context;
+    let { logger } = context, webEnvironments = filterWebEnvironments(context.environmentList), assetContext = {
+        ...context,
+        environmentList: webEnvironments,
+        publicPathnames: webEnvironments.map((environment)=>context.publicPathnames[environment.index])
+    };
     return async function assetsMiddleware(req, res, next) {
         async function goNext() {
             return new Promise((resolve)=>{
@@ -6796,7 +6811,7 @@ function createAssetsMiddleware(context, ready, outputFileSystem) {
         req.method && 'GET' !== req.method && 'HEAD' !== req.method ? await goNext() : ready(async function processRequest() {
             let readStream;
             if (!req.url) return void await goNext();
-            let resolved = await getFileFromUrl(req.url, outputFileSystem, context);
+            let resolved = await getFileFromUrl(req.url, outputFileSystem, assetContext);
             if (!resolved) return void await goNext();
             if ('errorCode' in resolved) {
                 403 === resolved.errorCode ? logger.error(`[rsbuild:middleware] Malicious path "${req.url}".`) : 400 === resolved.errorCode && logger.error(`[rsbuild:middleware] Invalid pathname "${req.url}".`), sendError(res, resolved.errorCode);
@@ -8423,7 +8438,7 @@ async function devServer_createDevServer(options, createCompiler, config, devSer
     }), logger.debug('create dev server done'), devServer;
 }
 async function startPreviewServer(context, config, { getPortSilently } = {}) {
-    let environmentList, { logger } = context, { connect } = await import("./connect-next.js"), middlewares = connect(), { port, portTip } = await resolvePort(config), serverConfig = config.server, { host, headers, proxy, historyApiFallback, compress, base, cors } = serverConfig, assetPrefixes = context.environmentList.map((environment)=>environment.config.output.assetPrefix);
+    let { logger } = context, { connect } = await import("./connect-next.js"), middlewares = connect(), { port, portTip } = await resolvePort(config), serverConfig = config.server, { host, headers, proxy, historyApiFallback, compress, base, cors } = serverConfig, assetPrefixes = context.environmentList.map((environment)=>environment.config.output.assetPrefix);
     context.publicPathnames = getPublicPathnames(assetPrefixes, base);
     let protocol = serverConfig.https ? 'https' : 'http', routes = getRoutes(context), urls = await getAddressUrls({
         protocol,
@@ -8467,13 +8482,9 @@ async function startPreviewServer(context, config, { getPortSilently } = {}) {
         server: previewServer,
         environments: context.environments
     });
-    let assetContext = (environmentList = context.environmentList.filter((environment)=>isWebTarget(environment.config.output.target)), {
-        ...context,
-        environmentList,
-        publicPathnames: environmentList.map((environment)=>context.publicPathnames[environment.index])
-    }), assetsMiddleware = createAssetsMiddleware(assetContext, (callback)=>callback(), node_fs), htmlMiddlewareOptions = {
+    let webEnvironments = filterWebEnvironments(context.environmentList), assetsMiddleware = createAssetsMiddleware(context, (callback)=>callback(), node_fs), htmlMiddlewareOptions = {
         assetsMiddleware,
-        distPaths: assetContext.environmentList.map((environment)=>environment.distPath),
+        distPaths: webEnvironments.map((environment)=>environment.distPath),
         outputFileSystem: node_fs
     };
     if (isVerbose(logger) && middlewares.use(getRequestLoggerMiddleware(logger)), cors) {
@@ -10209,7 +10220,7 @@ let applyServerOptions = (command)=>{
 };
 function setupCommands(argv) {
     let cli = ((name = "")=>new CAC(name))('rsbuild');
-    cli.version("2.2.2"), cli.option('--base <base>', 'Set the base path of the server').option('-c, --config <config>', 'Set the configuration file (relative or absolute path)').option('--config-loader <loader>', 'Set the config file loader (auto | jiti | native)', {
+    cli.version("2.2.3"), cli.option('--base <base>', 'Set the base path of the server').option('-c, --config <config>', 'Set the configuration file (relative or absolute path)').option('--config-loader <loader>', 'Set the config file loader (auto | jiti | native)', {
         default: 'auto'
     }).option('--dist-path <dir>', 'Set the root directory of output files').option('--source-map', 'Enable source map').option('--env-dir <dir>', 'Set the directory for loading `.env` files').option('--env-mode <mode>', 'Set the env mode to load the `.env.[mode]` file').option('--environment <name>', 'Set the environment name(s) to build', {
         type: [
@@ -10274,7 +10285,7 @@ function setupCommands(argv) {
 }
 function showGreeting() {
     let { npm_execpath, npm_lifecycle_event, NODE_RUN_SCRIPT_NAME } = process.env, isBun = npm_execpath?.includes('.bun');
-    src_logger.greet(`${'npx' === npm_lifecycle_event || isBun || NODE_RUN_SCRIPT_NAME ? '\n' : ''}Rsbuild v2.2.2\n`);
+    src_logger.greet(`${'npx' === npm_lifecycle_event || isBun || NODE_RUN_SCRIPT_NAME ? '\n' : ''}Rsbuild v2.2.3\n`);
 }
 function setupLogLevel(argv) {
     if (argv.length <= 3) return;
@@ -10296,5 +10307,5 @@ function runCLI({ argv = process.argv } = {}) {
         src_logger.error('Failed to start Rsbuild CLI.'), src_logger.error(err), process.exit(1);
     }
 }
-let src_version = "2.2.2";
+let src_version = "2.2.3";
 export { PLUGIN_CSS_NAME, PLUGIN_SWC_NAME, core_rspack as rspack, createRsbuild, defaultAllowedOrigins, defineConfig, ensureAssetPrefix, loadConfig_loadConfig as loadConfig, loadEnv, logger_createLogger as createLogger, mergeRsbuildConfig, mrmime_lookup, runCLI, src_logger as logger, src_version as version };

package/dist/server/assets-middleware/middleware.d.ts

@@ -1,2 +1,7 @@
 import type { InternalContext, RequestHandler, Rspack } from '../../types/index.js';
+/**
+ * Filters environments to those whose outputs may be exposed by the HTTP assets
+ * middleware. Node-targeted outputs are intended for server-side execution,
+ * such as through `loadBundle`, and must not participate in URL resolution.
+ */ export declare const filterWebEnvironments: (environmentList: InternalContext['environmentList']) => InternalContext['environmentList'];
 export declare function createAssetsMiddleware(context: InternalContext, ready: (callback: () => void) => void, outputFileSystem: Rspack.OutputFileSystem): RequestHandler;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsbuild/core",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "The Rspack-based build tool.",
   "homepage": "https://rsbuild.rs",
   "bugs": {