@vitest/browser 4.1.9 → 4.1.10

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { ResolvedConfig, BrowserServerFactory, BrowserCommand, BrowserProviderOption } from 'vitest/node';
+import { TestProject, ResolvedConfig, BrowserServerFactory, BrowserCommand, BrowserProviderOption } from 'vitest/node';
 import { ScreenshotMatcherOptions, NonStandardScreenshotComparators, ScreenshotComparatorRegistry } from '@vitest/browser/context';
 
 interface BaseMetadata {
@@ -61,6 +61,8 @@ declare function parseKeyDef(text: string): {
 	repeat: number;
 }[];
 declare function resolveScreenshotPath(testPath: string, name: string, config: ResolvedConfig, customPath: string | undefined): string;
+declare function assertBrowserFileAccess(project: TestProject, path: string): void;
+declare function assertBrowserApiWrite(project: TestProject, path: string): void;
 
 //#endregion
 //#region src/locatorGenerators.d.ts
@@ -89,5 +91,5 @@ declare function defineBrowserProvider<T extends object = object>(options: Omit<
 	options?: T;
 }): BrowserProviderOption;
 
-export { asLocator, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
+export { asLocator, assertBrowserApiWrite, assertBrowserFileAccess, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
 export type { CustomComparatorsRegistry };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { ManualMockedModule, RedirectedModule, AutomockedModule, AutospiedModule, MockerRegistry } from '@vitest/mocker';
 import { dynamicImportPlugin, ServerMockResolver, interceptorPlugin } from '@vitest/mocker/node';
 import c from 'tinyrainbow';
-import { isValidApiRequest, isFileServingAllowed, distDir, rolldownVersion, resolveApiServerConfig, resolveFsAllow, isFileLoadingAllowed, createDebugger, createViteLogger, createViteServer } from 'vitest/node';
+import { isFileLoadingAllowed, isValidApiRequest, isFileServingAllowed, distDir, rolldownVersion, resolveApiServerConfig, resolveFsAllow, createDebugger, createViteLogger, createViteServer } from 'vitest/node';
 import { fileURLToPath } from 'node:url';
 import fs, { readFileSync, createReadStream, promises, existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -18,7 +18,7 @@ import { PNG } from 'pngjs';
 import { diff } from '@blazediff/core';
 import { WebSocketServer } from 'ws';
 
-var version = "4.1.9";
+var version = "4.1.10";
 
 const _DRIVE_LETTER_START_RE = /^[A-Za-z]:\//;
 function normalizeWindowsPath(input = "") {
@@ -674,6 +674,17 @@ async function getBrowserProvider(options, project) {
 function slash(path) {
 	return path.replace(/\\/g, "/").replace(/\/+/g, "/");
 }
+function assertBrowserFileAccess(project, path) {
+	const normalized = slash(path);
+	if (!isFileLoadingAllowed(project.vite.config, normalized) && !isFileLoadingAllowed(project.vitest.vite.config, normalized)) {
+		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
+	}
+}
+function assertBrowserApiWrite(project, path) {
+	if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {
+		throw new Error(`Cannot modify file "${path}". File writing is disabled because the server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
+	}
+}
 
 async function resolveOrchestrator(globalServer, url, res) {
 	let sessionId = url.searchParams.get("sessionId");
@@ -1896,19 +1907,9 @@ _Mime_extensionToType = new WeakMap(), _Mime_typeToExtension = new WeakMap(), _M
 
 var mime = new Mime(types)._freeze();
 
-function assertFileAccess(path, project) {
-	if (!isFileLoadingAllowed(project.vite.config, path) && !isFileLoadingAllowed(project.vitest.vite.config, path)) {
-		throw new Error(`Access denied to "${path}". See Vite config documentation for "server.fs": https://vitejs.dev/config/server-options.html#server-fs-strict.`);
-	}
-}
-function assertWrite(path, project) {
-	if (!project.config.browser.api.allowWrite || !project.vitest.config.api.allowWrite) {
-		throw new Error(`Cannot modify file "${path}". File writing is disabled because server is exposed to the internet, see https://vitest.dev/config/browser/api.`);
-	}
-}
 const readFile = async ({ project }, path, options = {}) => {
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	// never return a Buffer
 	if (typeof options === "object" && !options.encoding) {
 		options.encoding = "utf-8";
@@ -1916,9 +1917,9 @@ const readFile = async ({ project }, path, options = {}) => {
 	return promises.readFile(filepath, options);
 };
 const writeFile = async ({ project }, path, data, options) => {
-	assertWrite(path, project);
+	assertBrowserApiWrite(project, path);
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	const dir = dirname$1(filepath);
 	if (!fs.existsSync(dir)) {
 		await promises.mkdir(dir, { recursive: true });
@@ -1926,14 +1927,14 @@ const writeFile = async ({ project }, path, data, options) => {
 	await promises.writeFile(filepath, data, options);
 };
 const removeFile = async ({ project }, path) => {
-	assertWrite(path, project);
+	assertBrowserApiWrite(project, path);
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	await promises.rm(filepath);
 };
 const _fileInfo = async ({ project }, path, encoding) => {
 	const filepath = resolve$1(project.config.root, path);
-	assertFileAccess(slash(filepath), project);
+	assertBrowserFileAccess(project, filepath);
 	const content = await promises.readFile(filepath, encoding || "base64");
 	return {
 		content,
@@ -2249,7 +2250,7 @@ const screenshotMatcher = async (context, name, testName, options) => {
 		comparator,
 		comparatorOptions
 	});
-	await performSideEffects(outcome, codec);
+	await performSideEffects(outcome, codec, context.project);
 	return buildOutput(outcome, timeout);
 };
 /**
@@ -2335,17 +2336,17 @@ async function determineOutcome({ comparator, comparatorOptions, paths, referenc
 *
 * Only `missing-reference`, `update-reference`, and `mismatch` write files. Successful matches produce no side effects.
 */
-async function performSideEffects(outcome, codec) {
+async function performSideEffects(outcome, codec, project) {
 	switch (outcome.type) {
 		case "missing-reference":
 		case "update-reference": {
-			await writeScreenshot(outcome.reference.path, await codec.encode(outcome.reference.image, {}));
+			await writeScreenshot(outcome.reference.path, await codec.encode(outcome.reference.image, {}), project);
 			break;
 		}
 		case "mismatch": {
-			await writeScreenshot(outcome.actual.path, await codec.encode(outcome.actual.image, {}));
+			await writeScreenshot(outcome.actual.path, await codec.encode(outcome.actual.image, {}), project);
 			if (outcome.diff) {
-				await writeScreenshot(outcome.diff.path, await codec.encode(outcome.diff.image, {}));
+				await writeScreenshot(outcome.diff.path, await codec.encode(outcome.diff.image, {}), project);
 			}
 			break;
 		}
@@ -2479,8 +2480,10 @@ async function getStableScreenshot({ codec, context, comparator, comparatorOptio
 	};
 }
 /** Writes encoded images to disk, creating parent directories as needed. */
-async function writeScreenshot(path, image) {
+async function writeScreenshot(path, image, project) {
 	try {
+		assertBrowserApiWrite(project, path);
+		assertBrowserFileAccess(project, path);
 		await mkdir(dirname(path), { recursive: true });
 		await writeFile$1(path, image);
 	} catch (cause) {
@@ -3114,6 +3117,16 @@ function setupBrowserRpc(globalServer, defaultMockerRegistry) {
 						artifact.attachments = [];
 						vitest.logger.error(`[vitest] Cannot record attachments ("${attachments}") because file writing is disabled, removing attachments from artifact "${artifact.type}". See https://vitest.dev/config/browser/api.`);
 					}
+				} else {
+					// attachment files are copied into `attachmentsDir`, so confine
+					// client-supplied paths to Vite's `server.fs` boundary
+					const attachments = artifact.type === "internal:annotation" ? artifact.annotation.attachment ? [artifact.annotation.attachment] : [] : artifact.attachments ?? [];
+					for (const attachment of attachments) {
+						const path = attachment.path;
+						if (path && !path.startsWith("http://") && !path.startsWith("https://")) {
+							checkFileAccess(resolve(project.config.root, path));
+						}
+					}
 				}
 				return vitest._testRun.recordArtifact(id, artifact);
 			},
@@ -7950,4 +7963,4 @@ function defineBrowserProvider(options) {
 	};
 }
 
-export { asLocator, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };
+export { asLocator, assertBrowserApiWrite, assertBrowserFileAccess, createBrowserServer, defineBrowserCommand, defineBrowserProvider, parseKeyDef, resolveScreenshotPath };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@vitest/browser",
   "type": "module",
-  "version": "4.1.9",
+  "version": "4.1.10",
   "description": "Browser running for Vitest",
   "license": "MIT",
   "funding": "https://opencollective.com/vitest",
@@ -57,7 +57,7 @@
     "providers"
   ],
   "peerDependencies": {
-    "vitest": "4.1.9"
+    "vitest": "4.1.10"
   },
   "dependencies": {
     "@blazediff/core": "1.9.1",
@@ -66,8 +66,8 @@
     "sirv": "^3.0.2",
     "tinyrainbow": "^3.1.0",
     "ws": "^8.19.0",
-    "@vitest/utils": "4.1.9",
-    "@vitest/mocker": "4.1.9"
+    "@vitest/mocker": "4.1.10",
+    "@vitest/utils": "4.1.10"
   },
   "devDependencies": {
     "@opentelemetry/api": "^1.9.0",
@@ -79,8 +79,8 @@
     "ivya": "^1.8.0",
     "mime": "^4.1.0",
     "pathe": "^2.0.3",
-    "vitest": "4.1.9",
-    "@vitest/runner": "4.1.9"
+    "@vitest/runner": "4.1.10",
+    "vitest": "4.1.10"
   },
   "scripts": {
     "typecheck": "tsc -p ./src/client/tsconfig.json --noEmit",