vite 6.1.4 → 6.1.6

package/dist/node/chunks/{dep-7B7unqQx.js → dep-BsiYfecU.js}

@@ -1,4 +1,4 @@
-import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-B--GINb9.js';
+import { Q as commonjsGlobal, P as getDefaultExportFromCjs } from './dep-DAc1iKf4.js';
 import require$$0$2 from 'fs';
 import require$$0 from 'postcss';
 import require$$0$1 from 'path';

package/dist/node/chunks/{dep-B--GINb9.js → dep-DAc1iKf4.js}

@@ -41823,8 +41823,11 @@ function sirv (dir, opts={}) {
 }
 
 const knownJavascriptExtensionRE = /\.(?:[tj]sx?|[cm][tj]s)$/;
+const ERR_DENIED_FILE = "ERR_DENIED_FILE";
 const sirvOptions = ({
-  getHeaders
+  config,
+  getHeaders,
+  disableFsServeCheck
 }) => {
   return {
     dev: true,
@@ -41840,6 +41843,19 @@ const sirvOptions = ({
           res.setHeader(name, headers[name]);
         }
       }
+    },
+    shouldServe: disableFsServeCheck ? undefined : (filePath) => {
+      const servingAccessResult = checkLoadingAccess(config, filePath);
+      if (servingAccessResult === "denied") {
+        const error = new Error("denied access");
+        error.code = ERR_DENIED_FILE;
+        error.path = filePath;
+        throw error;
+      }
+      if (servingAccessResult === "fallback") {
+        return false;
+      }
+      return true;
     }
   };
 };
@@ -41848,7 +41864,9 @@ function servePublicMiddleware(server, publicFiles) {
   const serve = sirv(
     dir,
     sirvOptions({
-      getHeaders: () => server.config.server.headers
+      config: server.config,
+      getHeaders: () => server.config.server.headers,
+      disableFsServeCheck: true
     })
   );
   const toFilePath = (url) => {
@@ -41874,6 +41892,7 @@ function serveStaticMiddleware(server) {
   const serve = sirv(
     dir,
     sirvOptions({
+      config: server.config,
       getHeaders: () => server.config.server.headers
     })
   );
@@ -41900,42 +41919,47 @@ function serveStaticMiddleware(server) {
       }
     }
     const resolvedPathname = redirectedPathname || pathname;
-    let fileUrl = path$d.resolve(dir, removeLeadingSlash(resolvedPathname));
-    if (resolvedPathname[resolvedPathname.length - 1] === "/" && fileUrl[fileUrl.length - 1] !== "/") {
-      fileUrl = withTrailingSlash(fileUrl);
-    }
-    if (!ensureServingAccess(fileUrl, server, res, next)) {
-      return;
-    }
+    path$d.resolve(dir, removeLeadingSlash(resolvedPathname));
     if (redirectedPathname) {
       url.pathname = encodeURI(redirectedPathname);
       req.url = url.href.slice(url.origin.length);
     }
-    serve(req, res, next);
+    try {
+      serve(req, res, next);
+    } catch (e) {
+      if (e && "code" in e && e.code === ERR_DENIED_FILE) {
+        respondWithAccessDenied(e.path, server, res);
+        return;
+      }
+      throw e;
+    }
   };
 }
 function serveRawFsMiddleware(server) {
   const serveFromRoot = sirv(
     "/",
-    sirvOptions({ getHeaders: () => server.config.server.headers })
+    sirvOptions({
+      config: server.config,
+      getHeaders: () => server.config.server.headers
+    })
   );
   return function viteServeRawFsMiddleware(req, res, next) {
     if (req.url.startsWith(FS_PREFIX)) {
       const url = new URL(req.url, "http://example.com");
       const pathname = decodeURI(url.pathname);
-      if (!ensureServingAccess(
-        slash$1(path$d.resolve(fsPathFromId(pathname))),
-        server,
-        res,
-        next
-      )) {
-        return;
-      }
       let newPathname = pathname.slice(FS_PREFIX.length);
       if (isWindows$3) newPathname = newPathname.replace(/^[A-Z]:/i, "");
       url.pathname = encodeURI(newPathname);
       req.url = url.href.slice(url.origin.length);
-      serveFromRoot(req, res, next);
+      try {
+        serveFromRoot(req, res, next);
+      } catch (e) {
+        if (e && "code" in e && e.code === ERR_DENIED_FILE) {
+          respondWithAccessDenied(e.path, server, res);
+          return;
+        }
+        throw e;
+      }
     } else {
       next();
     }
@@ -41959,25 +41983,35 @@ function isFileLoadingAllowed(config, filePath) {
   if (fs.allow.some((uri) => isUriInFilePath(uri, filePath))) return true;
   return false;
 }
-function ensureServingAccess(url, server, res, next) {
+function checkLoadingAccess(config, path2) {
+  if (isFileLoadingAllowed(config, slash$1(path2))) {
+    return "allowed";
+  }
+  if (isFileReadable(path2)) {
+    return "denied";
+  }
+  return "fallback";
+}
+function checkServingAccess(url, server) {
   if (isFileServingAllowed(url, server)) {
-    return true;
+    return "allowed";
   }
   if (isFileReadable(cleanUrl(url))) {
-    const urlMessage = `The request url "${url}" is outside of Vite serving allow list.`;
-    const hintMessage = `
+    return "denied";
+  }
+  return "fallback";
+}
+function respondWithAccessDenied(url, server, res) {
+  const urlMessage = `The request url "${url}" is outside of Vite serving allow list.`;
+  const hintMessage = `
 ${server.config.server.fs.allow.map((i) => `- ${i}`).join("\n")}
 
 Refer to docs https://vite.dev/config/server-options.html#server-fs-allow for configurations and more details.`;
-    server.config.logger.error(urlMessage);
-    server.config.logger.warnOnce(hintMessage + "\n");
-    res.statusCode = 403;
-    res.write(renderRestrictedErrorHTML(urlMessage + "\n" + hintMessage));
-    res.end();
-  } else {
-    next();
-  }
-  return false;
+  server.config.logger.error(urlMessage);
+  server.config.logger.warnOnce(hintMessage + "\n");
+  res.statusCode = 403;
+  res.write(renderRestrictedErrorHTML(urlMessage + "\n" + hintMessage));
+  res.end();
 }
 function renderRestrictedErrorHTML(msg) {
   const html = String.raw;
@@ -43537,7 +43571,18 @@ const rawRE = /[?&]raw\b/;
 const inlineRE$2 = /[?&]inline\b/;
 const svgRE = /\.svg\b/;
 function deniedServingAccessForTransform(url, server, res, next) {
-  return (rawRE.test(url) || urlRE.test(url) || inlineRE$2.test(url) || svgRE.test(url)) && !ensureServingAccess(url, server, res, next);
+  if (rawRE.test(url) || urlRE.test(url) || inlineRE$2.test(url) || svgRE.test(url)) {
+    const servingAccessResult = checkServingAccess(url, server);
+    if (servingAccessResult === "denied") {
+      respondWithAccessDenied(url, server, res);
+      return true;
+    }
+    if (servingAccessResult === "fallback") {
+      next();
+      return true;
+    }
+  }
+  return false;
 }
 function cachedTransformMiddleware(server) {
   return function viteCachedTransformMiddleware(req, res, next) {
@@ -44712,6 +44757,17 @@ function searchForWorkspaceRoot(current, root = searchForPackageRoot(current)) {
   return searchForWorkspaceRoot(dir, root);
 }
 
+function rejectInvalidRequestMiddleware() {
+  return function viteRejectInvalidRequestMiddleware(req, res, next) {
+    if (req.url?.includes("#")) {
+      res.writeHead(400);
+      res.end();
+      return;
+    }
+    return next();
+  };
+}
+
 function createServer(inlineConfig = {}) {
   return _createServer(inlineConfig, { listen: true });
 }
@@ -45049,6 +45105,7 @@ async function _createServer(inlineConfig = {}, options) {
   if (process.env.DEBUG) {
     middlewares.use(timeMiddleware(root));
   }
+  middlewares.use(rejectInvalidRequestMiddleware());
   const { cors } = serverConfig;
   if (cors !== false) {
     middlewares.use(corsMiddleware(typeof cors === "boolean" ? {} : cors));
@@ -50019,8 +50076,8 @@ function createCachedImport(imp) {
     return cached;
   };
 }
-const importPostcssImport = createCachedImport(() => import('./dep-stc9c31V.js').then(function (n) { return n.i; }));
-const importPostcssModules = createCachedImport(() => import('./dep-7B7unqQx.js').then(function (n) { return n.i; }));
+const importPostcssImport = createCachedImport(() => import('./dep-UkrSh7Qt.js').then(function (n) { return n.i; }));
+const importPostcssModules = createCachedImport(() => import('./dep-BsiYfecU.js').then(function (n) { return n.i; }));
 const importPostcss = createCachedImport(() => import('postcss'));
 const preprocessorWorkerControllerCache = /* @__PURE__ */ new WeakMap();
 let alwaysFakeWorkerWorkerControllerCache;

package/dist/node/chunks/{dep-stc9c31V.js → dep-UkrSh7Qt.js}

@@ -1,4 +1,4 @@
-import { P as getDefaultExportFromCjs } from './dep-B--GINb9.js';
+import { P as getDefaultExportFromCjs } from './dep-DAc1iKf4.js';
 import require$$0 from 'path';
 import { l as lib } from './dep-3RmXg9uo.js';
 

package/dist/node/cli.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import fs__default from 'node:fs';
 import { performance } from 'node:perf_hooks';
 import { EventEmitter } from 'events';
-import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-B--GINb9.js';
+import { O as colors, I as createLogger, r as resolveConfig } from './chunks/dep-DAc1iKf4.js';
 import { VERSION } from './constants.js';
 import 'node:fs/promises';
 import 'node:url';
@@ -745,7 +745,7 @@ cli.command("[root]", "start dev server").alias("serve").alias("dev").option("--
   `[boolean] force the optimizer to ignore the cache and re-bundle`
 ).action(async (root, options) => {
   filterDuplicateOptions(options);
-  const { createServer } = await import('./chunks/dep-B--GINb9.js').then(function (n) { return n.S; });
+  const { createServer } = await import('./chunks/dep-DAc1iKf4.js').then(function (n) { return n.S; });
   try {
     const server = await createServer({
       root,
@@ -839,7 +839,7 @@ cli.command("build [root]", "build for production").option("--target <target>",
 ).option("-w, --watch", `[boolean] rebuilds when modules have changed on disk`).option("--app", `[boolean] same as \`builder: {}\``).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { createBuilder } = await import('./chunks/dep-B--GINb9.js').then(function (n) { return n.T; });
+    const { createBuilder } = await import('./chunks/dep-DAc1iKf4.js').then(function (n) { return n.T; });
     const buildOptions = cleanGlobalCLIOptions(
       cleanBuilderCLIOptions(options)
     );
@@ -878,7 +878,7 @@ cli.command(
 ).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { optimizeDeps } = await import('./chunks/dep-B--GINb9.js').then(function (n) { return n.R; });
+    const { optimizeDeps } = await import('./chunks/dep-DAc1iKf4.js').then(function (n) { return n.R; });
     try {
       const config = await resolveConfig(
         {
@@ -905,7 +905,7 @@ ${e.stack}`),
 cli.command("preview [root]", "locally preview production build").option("--host [host]", `[string] specify hostname`, { type: [convertHost] }).option("--port <port>", `[number] specify port`).option("--strictPort", `[boolean] exit if specified port is already in use`).option("--open [path]", `[boolean | string] open browser on startup`).option("--outDir <dir>", `[string] output directory (default: dist)`).action(
   async (root, options) => {
     filterDuplicateOptions(options);
-    const { preview } = await import('./chunks/dep-B--GINb9.js').then(function (n) { return n.U; });
+    const { preview } = await import('./chunks/dep-DAc1iKf4.js').then(function (n) { return n.U; });
     try {
       const server = await preview({
         root,

package/dist/node/index.d.ts

@@ -4167,11 +4167,9 @@ declare function searchForWorkspaceRoot(current: string, root?: string): string;
 
 /**
  * Check if the url is allowed to be served, via the `server.fs` config.
+ * @deprecated Use the `isFileLoadingAllowed` function instead.
  */
 declare function isFileServingAllowed(config: ResolvedConfig, url: string): boolean;
-/**
- * @deprecated Use the `isFileServingAllowed(config, url)` signature instead.
- */
 declare function isFileServingAllowed(url: string, server: ViteDevServer): boolean;
 declare function isFileLoadingAllowed(config: ResolvedConfig, filePath: string): boolean;
 

package/dist/node/index.js

@@ -1,6 +1,6 @@
 export { parseAst, parseAstAsync } from 'rollup/parseAst';
-import { i as isInNodeModules, a as arraify } from './chunks/dep-B--GINb9.js';
-export { B as BuildEnvironment, D as DevEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-B--GINb9.js';
+import { i as isInNodeModules, a as arraify } from './chunks/dep-DAc1iKf4.js';
+export { B as BuildEnvironment, D as DevEnvironment, f as build, m as buildErrorMessage, g as createBuilder, F as createFilter, h as createIdResolver, I as createLogger, n as createRunnableDevEnvironment, c as createServer, y as createServerHotChannel, w as createServerModuleRunner, x as createServerModuleRunnerTransport, d as defineConfig, v as fetchModule, j as formatPostcssSourceMap, L as isFileLoadingAllowed, K as isFileServingAllowed, q as isRunnableDevEnvironment, l as loadConfigFromFile, M as loadEnv, E as mergeAlias, C as mergeConfig, z as moduleRunnerTransform, A as normalizePath, o as optimizeDeps, p as perEnvironmentPlugin, b as perEnvironmentState, k as preprocessCSS, e as preview, r as resolveConfig, N as resolveEnvPrefix, G as rollupVersion, u as runnerImport, J as searchForWorkspaceRoot, H as send, s as sortUserPlugins, t as transformWithEsbuild } from './chunks/dep-DAc1iKf4.js';
 export { defaultAllowedOrigins, DEFAULT_CLIENT_CONDITIONS as defaultClientConditions, DEFAULT_CLIENT_MAIN_FIELDS as defaultClientMainFields, DEFAULT_SERVER_CONDITIONS as defaultServerConditions, DEFAULT_SERVER_MAIN_FIELDS as defaultServerMainFields, VERSION as version } from './constants.js';
 export { version as esbuildVersion } from 'esbuild';
 import 'node:fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite",
-  "version": "6.1.4",
+  "version": "6.1.6",
   "type": "module",
   "license": "MIT",
   "author": "Evan You",