@umijs/bundler-webpack 4.6.64 → 4.6.66

package/dist/server/server.js

@@ -41,6 +41,7 @@ var import_fs = require("fs");
 var import_http = __toESM(require("http"));
 var import_path = require("path");
 var import_constants = require("../constants");
+var import_utils2 = require("./utils");
 var import_ws = require("./ws");
 async function createServer(opts) {
   const { webpackConfig, userConfig } = opts;
@@ -59,7 +60,14 @@ async function createServer(opts) {
   }
   app.use((req, res, next) => {
     const file = req.path;
-    const filePath = (0, import_path.join)(opts.cwd, file);
+    const filePath = (0, import_utils2.resolvePathWithinRoot)(opts.cwd, file);
+    if (!filePath) {
+      if ((0, import_path.extname)(file) === ".js") {
+        res.status(403).end("Forbidden");
+        return;
+      }
+      return next();
+    }
     const ext = (0, import_path.extname)(filePath);
     if (ext === ".js" && (0, import_fs.existsSync)(filePath)) {
       import_utils.logger.info(

package/dist/server/utils.d.ts

@@ -0,0 +1 @@
+export declare function resolvePathWithinRoot(root: string, file: string): string | null;

package/dist/server/utils.js

@@ -0,0 +1,38 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/server/utils.ts
+var utils_exports = {};
+__export(utils_exports, {
+  resolvePathWithinRoot: () => resolvePathWithinRoot
+});
+module.exports = __toCommonJS(utils_exports);
+var import_path = require("path");
+function resolvePathWithinRoot(root, file) {
+  const resolvedRoot = (0, import_path.resolve)(root);
+  const filePath = (0, import_path.resolve)(resolvedRoot, `.${file}`);
+  const relativePath = (0, import_path.relative)(resolvedRoot, filePath);
+  if (relativePath === ".." || relativePath.startsWith(`..${import_path.sep}`) || (0, import_path.isAbsolute)(relativePath)) {
+    return null;
+  }
+  return filePath;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  resolvePathWithinRoot
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umijs/bundler-webpack",
-  "version": "4.6.64",
+  "version": "4.6.66",
   "description": "@umijs/bundler-webpack",
   "homepage": "https://github.com/umijs/umi/tree/master/packages/bundler-webpack#readme",
   "bugs": "https://github.com/umijs/umi/issues",
@@ -38,10 +38,10 @@
     "postcss-preset-env": "7.5.0",
     "react-error-overlay": "6.0.9",
     "react-refresh": "0.14.0",
-    "@umijs/bundler-utils": "4.6.64",
-    "@umijs/utils": "4.6.64",
-    "@umijs/mfsu": "4.6.64",
-    "@umijs/babel-preset-umi": "4.6.64"
+    "@umijs/babel-preset-umi": "4.6.66",
+    "@umijs/utils": "4.6.66",
+    "@umijs/mfsu": "4.6.66",
+    "@umijs/bundler-utils": "4.6.66"
   },
   "devDependencies": {
     "@swc/core": "1.3.67",