bun-plugin-stx 0.2.172 → 0.2.174

package/dist/serve.d.ts

@@ -42,6 +42,25 @@ export declare function routeSpecificity(fileRouteBase: string): number;
  * `.html`) return false; those are routable.
  */
 export declare function isStaticAssetPath(requestPath: string): boolean;
+/**
+ * Does a file actually exist under `publicDir` for this request path?
+ *
+ * The extension test above is a guess about intent, and it is the wrong
+ * question to ask before dropping a catch-all: an app whose catch-all
+ * legitimately serves paths that carry extensions - a file browser, a docs
+ * site addressing `guide.md`, anything rendering a repository - has every
+ * such page refused, because the guess says "asset" and the only route that
+ * could answer is the one being dropped.
+ *
+ * Asking the disk instead keeps what stacksjs/stx#1841 was protecting (a real
+ * `public/images/logo.jpg` still wins over `[...all].stx`) and costs one stat
+ * on a path that was going to be looked up moments later anyway.
+ *
+ * Traversal is normalized before the prefix check, the same way the publicDir
+ * handler does it, so `..` cannot walk out of the root and report on a file
+ * that is none of the caller's business.
+ */
+export declare function publicFileExists(requestPath: string, publicDir: string): boolean;
 /**
  * Are we serving in production? In production the built-in 404 must not
  * enumerate the app's route list (information disclosure) and must not

package/dist/serve.js

@@ -9,7 +9,7 @@ import {
 
 // src/serve.ts
 var {serve: bunServe, Glob } = globalThis.Bun;
-import { watch as fsWatch } from "fs";
+import { existsSync as existsSync2, watch as fsWatch, statSync as statSync3 } from "fs";
 import nodeFs from "fs/promises";
 import nodePath from "path";
 import process19 from "process";
@@ -8813,6 +8813,26 @@ function routeSpecificity(fileRouteBase) {
 function isStaticAssetPath(requestPath) {
   return /\.[a-z0-9]+$/i.test(requestPath) && !/\.(?:stx|md|html)$/i.test(requestPath);
 }
+function publicFileExists(requestPath, publicDir) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(requestPath);
+  } catch {
+    decoded = requestPath;
+  }
+  if (decoded.includes("\x00"))
+    return false;
+  const publicRoot = nodePath.resolve(process19.cwd(), publicDir);
+  const resolved = nodePath.resolve(publicRoot, `.${decoded}`);
+  const inside = resolved === publicRoot || resolved.startsWith(`${publicRoot}${nodePath.sep}`);
+  if (!inside)
+    return false;
+  try {
+    return existsSync2(resolved) && !statSync3(resolved).isDirectory();
+  } catch {
+    return false;
+  }
+}
 function escapeHtml(input) {
   return input.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
@@ -9864,7 +9884,7 @@ function __stxOverlay(errs){
         }
       }
     }
-    const isAssetRequest = isStaticAssetPath(normalizedPath);
+    const isAssetRequest = publicFileExists(`/${normalizedPath}`, publicDir);
     const dynamicFiles = files.filter((f) => {
       const nf = f.replace(/^\.\//, "").replace(/\\/g, "/");
       if (!nf.includes("["))
@@ -10840,6 +10860,7 @@ export {
   routeSpecificity,
   resolveServeOpenUrl,
   render404Page,
+  publicFileExists,
   isStaticAssetPath,
   isRenderableCacheCandidate,
   isRenderFailure,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "bun-plugin-stx",
   "type": "module",
-  "version": "0.2.172",
+  "version": "0.2.174",
   "description": "A Bun plugin that allows for using Laravel Blade-like syntax.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",