Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: prevent serving unrestricted files (fix #2820) #2850

Merged
merged 24 commits into from
May 7, 2021
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
feat: search for workspace root
  • Loading branch information
antfu committed May 4, 2021
commit f4e386947ce1dee0d94a39fbe14bf0dcae4f99ef
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"private": true
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"private": true
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"private": true
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"private": true
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"private": true,
"workspaces": [
"nested"
]
}
37 changes: 37 additions & 0 deletions packages/vite/src/node/server/__tests__/search-root.spec.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
import { searchForWorkspaceRoot } from '../searchRoot'
import { resolve } from 'path'

describe('searchForWorkspaceRoot', () => {
test('pnpm', () => {
const resolved = searchForWorkspaceRoot(
resolve(__dirname, 'fixtures/pnpm/nested'),
5
)
expect(resolved).toBe(resolve(__dirname, 'fixtures/pnpm'))
})

test('yarn', () => {
const resolved = searchForWorkspaceRoot(
resolve(__dirname, 'fixtures/yarn/nested'),
5
)
expect(resolved).toBe(resolve(__dirname, 'fixtures/yarn'))
})

test('none', () => {
const resolved = searchForWorkspaceRoot(
resolve(__dirname, 'fixtures/none/nested'),
3
)
expect(resolved).toBe(resolve(__dirname, 'fixtures/none/nested'))
})

test('deeper', () => {
const resolved = searchForWorkspaceRoot(
resolve(__dirname, 'fixtures/none/nested'),
10
)
// resolved to vite repo's root
expect(resolved).toBe(resolve(__dirname, '../../../../../..'))
})
})
50 changes: 50 additions & 0 deletions packages/vite/src/node/server/searchRoot.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
import fs from 'fs'
import { dirname } from 'path'
import { join } from 'path'

// https://github.com/vitejs/vite/issues/2820#issuecomment-812495079
const ROOT_FILES = [
'.git',

// https://pnpm.js.org/workspaces/
'pnpm-workspace.yaml'

// https://rushjs.io/pages/advanced/config_files/
// 'rush.json',

// https://nx.dev/latest/react/getting-started/nx-setup
// 'workspace.json',
// 'nx.json'
antfu marked this conversation as resolved.
Show resolved Hide resolved
]

// npm: https://docs.npmjs.com/cli/v7/using-npm/workspaces#installing-workspaces
// yarn: https://classic.yarnpkg.com/en/docs/workspaces/#toc-how-to-use-it
function hasWorkspacePackageJSON(root: string): boolean {
const path = join(root, 'package.json')
if (!fs.existsSync(path)) return false
const content = JSON.parse(fs.readFileSync(path, 'utf-8')) || {}
antfu marked this conversation as resolved.
Show resolved Hide resolved
return !!content.workspaces
}

function hasRootFile(root: string): boolean {
for (const file of ROOT_FILES) {
if (fs.existsSync(join(root, file))) return true
}
return false
antfu marked this conversation as resolved.
Show resolved Hide resolved
}

export function searchForWorkspaceRoot(
current: string,
depth: number,
root = current
): string {
if (depth <= 0) return root
if (hasRootFile(current)) return current
if (hasWorkspacePackageJSON(current)) return current

const dir = dirname(current)
// reach the fs root
if (dir === current) return root

return searchForWorkspaceRoot(dir, depth - 1, root)
}