Vite dev server optionserver.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.
Impact
Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Patches
Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18
Details
server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.
Reproduction
Set fs.deny to ['**/.git/**'] and then curl for /.git/config.
with matchBase: true, you can get any file under .git/ (config, HEAD, etc).
with matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).
This PR contains the following updates:
4.5.2->4.5.3GitHub Vulnerability Alerts
CVE-2024-31207
Summary
Vite dev server option
server.fs.denydid not deny requests for patterns with directories. An example of such a pattern is/foo/**/*.Impact
Only apps setting a custom
server.fs.denythat includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using--hostorserver.hostconfig option) are affected.Patches
Fixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18
Details
server.fs.denyuses picomatch with the config of{ matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set{ dot: true }and that causes dotfiles not to be denied unless they are explicitly defined.Reproduction
Set fs.deny to
['**/.git/**']and then curl for/.git/config.matchBase: true, you can get any file under.git/(config, HEAD, etc).matchBase: false, you cannot get any file under.git/(config, HEAD, etc).Release Notes
vitejs/vite (vite)
### [`v4.5.3`](https://redirect.github.com/vitejs/vite/compare/v4.5.2...aac695e9f8f29da43c2f7c50c549fa3d3dfeeadc) [Compare Source](https://redirect.github.com/vitejs/vite/compare/v4.5.2...v4.5.3)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.