vitejs · antfu · May 7, 2021 · Apr 4, 2021 · Apr 4, 2021 · Apr 4, 2021
diff --git a/docs/config/index.md b/docs/config/index.md
@@ -420,6 +420,14 @@ export default async ({ command, mode }) => {
 
   File system watcher options to pass on to [chokidar](https://github.com/paulmillr/chokidar#api).
 
+### server.fsServeRoot
+
+- **Type:** `string`
+
+  Restrict files that could be served via `/@fs/`. Accessing files outside this directory will result in a 403.
+
+  Default to [project root](/guide/#index-html-and-project-root).
+
 ## Build Options
 
 ### build.target

diff --git a/packages/vite/src/node/server/index.ts b/packages/vite/src/node/server/index.ts
@@ -120,6 +120,14 @@ export interface ServerOptions {
    * Should start and end with the `/` character
    */
   base?: string
+  /**
+   * Restrict files that could be served via '/\@fs/'.
+   * Accessing files outside this directory will result in a 403.
+   *
+   * Accepts absolute path or a path relative to project root.
+   * Default to the project root.
+   */
+  fsServeRoot?: string
 }
 
 /**
@@ -438,7 +446,7 @@ export async function createServer(
   middlewares.use(transformMiddleware(server))
 
   // serve static files
-  middlewares.use(serveRawFsMiddleware())
+  middlewares.use(serveRawFsMiddleware(config))
   middlewares.use(serveStaticMiddleware(root, config))
 
   // spa fallback

diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts
@@ -72,9 +72,15 @@ export function serveStaticMiddleware(
   }
 }
 
-export function serveRawFsMiddleware(): Connect.NextHandleFunction {
+export function serveRawFsMiddleware(
+  config: ResolvedConfig
+): Connect.NextHandleFunction {
   const isWin = os.platform() === 'win32'
   const serveFromRoot = sirv('/', sirvOptions)
+  const root = path.resolve(
+    config.root,
+    config.server?.fsServeRoot || config.root
+  )
 
   return (req, res, next) => {
     let url = req.url!
@@ -84,6 +90,18 @@ export function serveRawFsMiddleware(): Connect.NextHandleFunction {
     // searching based from fs root.
     if (url.startsWith(FS_PREFIX)) {
       url = url.slice(FS_PREFIX.length)
+
+      // restrict files outside of `fsServeRoot`
+      if (
+        path
+          .relative(root, path.isAbsolute(url) ? url : `/${url}`)
+          .startsWith('../')
+      ) {
+        res.statusCode = 403
+        res.end()
+        return
+      }
+
       if (isWin) url = url.replace(/^[A-Z]:/i, '')
 
       req.url = url