vite 4.5.12 → 4.5.13

package/dist/node/chunks/{dep-845e3752.js → dep-42dae6ba.js}

@@ -38995,8 +38995,8 @@ function createCachedImport(imp) {
         return cached;
     };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-faa9987b.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-5215c85e.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-6e2b5186.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-e967375e.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 /**
  * @experimental
@@ -65258,6 +65258,25 @@ class ModuleGraph {
     }
 }
 
+function rejectInvalidRequestMiddleware() {
+    // Keep the named function. The name is visible in debug logs via `DEBUG=connect:dispatcher ...`
+    return function viteRejectInvalidRequestMiddleware(req, res, next) {
+        // HTTP spec does not allow `#` in the request-target
+        // (HTTP 1.1: https://datatracker.ietf.org/doc/html/rfc9112#section-3.2)
+        // (HTTP 2: https://datatracker.ietf.org/doc/html/rfc9113#section-8.3.1-2.4.1)
+        // But Node.js allows those requests.
+        // Our middlewares don't expect `#` to be included in `req.url`, especially the `server.fs.deny` checks.
+        if (req.url?.includes('#')) {
+            // HTTP 1.1 spec recommends sending 400 Bad Request
+            // (https://datatracker.ietf.org/doc/html/rfc9112#section-3.2-4)
+            res.writeHead(400);
+            res.end();
+            return;
+        }
+        return next();
+    };
+}
+
 function createServer(inlineConfig = {}) {
     return _createServer(inlineConfig, { ws: true });
 }
@@ -65473,6 +65492,8 @@ async function _createServer(inlineConfig = {}, options) {
     if (process.env.DEBUG) {
         middlewares.use(timeMiddleware(root));
     }
+    // disallows request that contains `#` in the URL
+    middlewares.use(rejectInvalidRequestMiddleware());
     // cors
     const { cors } = serverConfig;
     if (cors !== false) {

package/dist/node/chunks/{dep-faa9987b.js → dep-6e2b5186.js}

@@ -1,4 +1,4 @@
-import { E as getDefaultExportFromCjs } from './dep-845e3752.js';
+import { E as getDefaultExportFromCjs } from './dep-42dae6ba.js';
 import require$$0 from 'path';
 import require$$0__default from 'fs';
 import { l as lib } from './dep-c423598f.js';

package/dist/node/chunks/{dep-5215c85e.js → dep-e967375e.js}

@@ -1,4 +1,4 @@
-import { F as commonjsGlobal, E as getDefaultExportFromCjs } from './dep-845e3752.js';
+import { F as commonjsGlobal, E as getDefaultExportFromCjs } from './dep-42dae6ba.js';
 import require$$0__default from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { C as colors, D as bindShortcuts, x as createLogger, h as resolveConfig } from './chunks/dep-845e3752.js';
+import { C as colors, D as bindShortcuts, x as createLogger, h as resolveConfig } from './chunks/dep-42dae6ba.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -759,7 +759,7 @@ cli
     filterDuplicateOptions(options);
     // output structure is preserved even after bundling so require()
     // is ok here
-    const { createServer } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.I; });
+    const { createServer } = await import('./chunks/dep-42dae6ba.js').then(function (n) { return n.I; });
     try {
         const server = await createServer({
             root,
@@ -837,7 +837,7 @@ cli
     .option('-w, --watch', `[boolean] rebuilds when modules have changed on disk`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { build } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.H; });
+    const { build } = await import('./chunks/dep-42dae6ba.js').then(function (n) { return n.H; });
     const buildOptions = cleanOptions(options);
     try {
         await build({
@@ -865,7 +865,7 @@ cli
     .option('--force', `[boolean] force the optimizer to ignore the cache and re-bundle`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.G; });
+    const { optimizeDeps } = await import('./chunks/dep-42dae6ba.js').then(function (n) { return n.G; });
     try {
         const config = await resolveConfig({
             root,
@@ -892,7 +892,7 @@ cli
     .option('--outDir <dir>', `[string] output directory (default: dist)`)
     .action(async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-845e3752.js').then(function (n) { return n.J; });
+    const { preview } = await import('./chunks/dep-42dae6ba.js').then(function (n) { return n.J; });
     try {
         const server = await preview({
             root,

package/dist/node/index.js

@@ -1,5 +1,5 @@
-import { i as isInNodeModules } from './chunks/dep-845e3752.js';
-export { b as build, e as buildErrorMessage, v as createFilter, x as createLogger, c as createServer, g as defineConfig, f as formatPostcssSourceMap, k as getDepOptimizationConfig, m as isDepsOptimizerEnabled, z as isFileServingAllowed, l as loadConfigFromFile, A as loadEnv, u as mergeAlias, q as mergeConfig, n as normalizePath, o as optimizeDeps, a as preprocessCSS, p as preview, j as resolveBaseUrl, h as resolveConfig, B as resolveEnvPrefix, d as resolvePackageData, r as resolvePackageEntry, y as searchForWorkspaceRoot, w as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-845e3752.js';
+import { i as isInNodeModules } from './chunks/dep-42dae6ba.js';
+export { b as build, e as buildErrorMessage, v as createFilter, x as createLogger, c as createServer, g as defineConfig, f as formatPostcssSourceMap, k as getDepOptimizationConfig, m as isDepsOptimizerEnabled, z as isFileServingAllowed, l as loadConfigFromFile, A as loadEnv, u as mergeAlias, q as mergeConfig, n as normalizePath, o as optimizeDeps, a as preprocessCSS, p as preview, j as resolveBaseUrl, h as resolveConfig, B as resolveEnvPrefix, d as resolvePackageData, r as resolvePackageEntry, y as searchForWorkspaceRoot, w as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-42dae6ba.js';
 export { VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 export { VERSION as rollupVersion } from 'rollup';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "4.5.12",
+  "version": "4.5.13",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",