| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| vite | ≥ 2.7.0, < 2.9.18≥ 3.0.0, < 3.2.10≥ 4.0.0, < 4.5.3≥ 5.0.0, < 5.0.13≥ 5.1.0, < 5.1.7≥ 5.2.0, < 5.2.6 | 2.9.183.2.104.5.35.0.135.1.75.2.6 |
Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.
Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Fixed in [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
server.fs.deny uses picomatch with the config of { matchBase: true }. matchBase only matches the basename of the file, not the path due to a bug (https://github.com/micromatch/picomatch/issues/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set { dot: true } and that causes dotfiles not to be denied unless they are explicitly defined.
Reproduction
Set fs.deny to ['**/.git/**'] and then curl for /.git/config.
matchBase: true, you can get any file under .git/ (config, HEAD, etc).matchBase: false, you cannot get any file under .git/ (config, HEAD, etc).Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí