@vitest/browser 3.2.5 → 3.2.7

package/dist/index.js

@@ -1,7 +1,7 @@
 import { ManualMockedModule, RedirectedModule, AutomockedModule, AutospiedModule, MockerRegistry } from '@vitest/mocker';
 import { dynamicImportPlugin, ServerMockResolver, interceptorPlugin } from '@vitest/mocker/node';
 import c from 'tinyrainbow';
-import { getFilePoolName, distDir, resolveApiServerConfig, resolveFsAllow, isFileServingAllowed, createDebugger, isValidApiRequest, createViteLogger, createViteServer } from 'vitest/node';
+import { isFileServingAllowed, getFilePoolName, distDir, resolveApiServerConfig, resolveFsAllow, createDebugger, isValidApiRequest, createViteLogger, createViteServer } from 'vitest/node';
 import fs, { readFileSync, lstatSync, promises, existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { slash as slash$1, toArray, createDefer } from '@vitest/utils';
@@ -19,7 +19,7 @@ import { WebSocketServer } from 'ws';
 import * as nodeos from 'node:os';
 import { performance } from 'node:perf_hooks';
 
-var version = "3.2.5";
+var version = "3.2.7";
 
 const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
 function normalizeWindowsPath(input = "") {
@@ -324,6 +324,17 @@ const stringify = (value, replacer, space) => {
 function replacer(code, values) {
 	return code.replace(/\{\s*(\w+)\s*\}/g, (_, key) => values[key] ?? _);
 }
+function assertBrowserFileAccess(project, path) {
+	const normalized = slash(path);
+	if (!isFileServingAllowed(normalized, project.vite) && !isFileServingAllowed(normalized, project.vitest.server)) {
+		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
+	}
+}
+function assertBrowserApiWrite(project, path) {
+	if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {
+		throw new Error(`Cannot modify file "${path}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
+	}
+}
 const builtinProviders = [
 	"webdriverio",
 	"playwright",
@@ -2382,6 +2393,10 @@ const screenshot = async (context, name, options = {}) => {
 	}
 	const path = options.path ? resolve(dirname(context.testPath), options.path) : resolveScreenshotPath(context.testPath, name, context.project.config);
 	const savePath = normalize$1(path);
+	if (options.save) {
+		assertBrowserApiWrite(context.project, savePath);
+		assertBrowserFileAccess(context.project, savePath);
+	}
 	await mkdir(dirname(path), { recursive: true });
 	if (context.provider instanceof PlaywrightBrowserProvider) {
 		if (options.element) {
@@ -2518,7 +2533,9 @@ const upload = async (context, selector, files, options) => {
 		const { iframe } = context;
 		const playwrightFiles = files.map((file) => {
 			if (typeof file === "string") {
-				return resolve(root, file);
+				const filepath = resolve(root, file);
+				assertBrowserFileAccess(context.project, filepath);
+				return filepath;
 			}
 			return {
 				name: file.name,
@@ -2536,6 +2553,7 @@ const upload = async (context, selector, files, options) => {
 		const element = context.browser.$(selector);
 		for (const file of files) {
 			const filepath = resolve(root, file);
+			assertBrowserFileAccess(context.project, filepath);
 			const remoteFilePath = await context.browser.uploadFile(filepath);
 			await element.addValue(remoteFilePath);
 		}
@@ -3119,6 +3137,16 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 				}
 			},
 			async onTaskAnnotate(id, annotation) {
+				const attachment = annotation.attachment;
+				if (attachment?.path && !attachment.path.startsWith("http://") && !attachment.path.startsWith("https://")) {
+					// attachment files are copied into `attachmentsDir`, so confine
+					// client-supplied paths to Vite's `server.fs` boundary
+					checkFileAccess(resolve(project.config.root, attachment.path));
+					if (!canWrite(project)) {
+						annotation.attachment = undefined;
+						vitest.logger.error(`[vitest] Cannot record annotation attachment because file writing is disabled. See https://vitest.dev/config/browser/api.`);
+					}
+				}
 				return vitest._testRun.annotate(id, annotation);
 			},
 			async onTaskUpdate(method, packs, events) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vitest/browser",
   "type": "module",
-  "version": "3.2.5",
+  "version": "3.2.7",
   "description": "Browser running for Vitest",
   "license": "MIT",
   "funding": "https://opencollective.com/vitest",
@@ -66,7 +66,7 @@
   "peerDependencies": {
     "playwright": "*",
     "webdriverio": "^7.0.0 || ^8.0.0 || ^9.0.0",
-    "vitest": "3.2.5"
+    "vitest": "3.2.7"
   },
   "peerDependenciesMeta": {
     "playwright": {
@@ -86,8 +86,8 @@
     "sirv": "^3.0.1",
     "tinyrainbow": "^2.0.0",
     "ws": "^8.18.2",
-    "@vitest/mocker": "3.2.5",
-    "@vitest/utils": "3.2.5"
+    "@vitest/utils": "3.2.7",
+    "@vitest/mocker": "3.2.7"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",
@@ -103,10 +103,10 @@
     "playwright-core": "^1.53.0",
     "safaridriver": "^1.0.0",
     "webdriverio": "^9.15.0",
-    "@vitest/runner": "3.2.5",
-    "@vitest/ui": "3.2.5",
-    "@vitest/ws-client": "3.2.5",
-    "vitest": "3.2.5"
+    "@vitest/runner": "3.2.7",
+    "@vitest/ui": "3.2.7",
+    "vitest": "3.2.7",
+    "@vitest/ws-client": "3.2.7"
   },
   "scripts": {
     "build": "rimraf dist && pnpm build:node && pnpm build:client",