fix: fs.deny with globs with directories (#16250)

Author: sapphi-red

packages/vite/src/node/server/index.ts

@@ -685,10 +685,19 @@ export async function _createServer(
 _importGlobMap: newMap(),
 _forceOptimizeOnRestart: false,
 _pendingRequests: newMap(),
-_fsDenyGlob: picomatch(config.server.fs.deny,{
-matchBase: true,
-nocase: true,
-}),
+_fsDenyGlob: picomatch(
+// matchBase: true does not work as it's documented
+// https://github.com/micromatch/picomatch/issues/89
+// convert patterns without `/` on our side for now
+config.server.fs.deny.map((pattern)=>
+pattern.includes('/') ? pattern : `**/${pattern}`,
+),
+{
+matchBase: false,
+nocase: true,
+dot: true,
+},
+),
 _shortcutsOptions: undefined,
 }
 

playground/fs-serve/__tests__/deny/fs-serve-deny.spec.ts

@@ -0,0 +1,17 @@
+import{describe,expect,test}from'vitest'
+import{isServe,page,viteTestUrl}from'~utils'
+
+describe.runIf(isServe)('main',()=>{
+test('**/deny/** should deny src/deny/deny.txt',async()=>{
+constres=awaitpage.request.fetch(
+newURL('/src/deny/deny.txt',viteTestUrl).href,
+)
+expect(res.status()).toBe(403)
+})
+test('**/deny/** should deny src/deny/.deny',async()=>{
+constres=awaitpage.request.fetch(
+newURL('/src/deny/.deny',viteTestUrl).href,
+)
+expect(res.status()).toBe(403)
+})
+})

playground/fs-serve/package.json

@@ -10,6 +10,9 @@
 "preview": "vite preview root",
 "dev:base": "vite root --config ./root/vite.config-base.js",
 "build:base": "vite build root --config ./root/vite.config-base.js",
-"preview:base": "vite preview root --config ./root/vite.config-base.js"
+"preview:base": "vite preview root --config ./root/vite.config-base.js",
+"dev:deny": "vite root --config ./root/vite.config-deny.js",
+"build:deny": "vite build root --config ./root/vite.config-deny.js",
+"preview:deny": "vite preview root --config ./root/vite.config-deny.js"
  }
 }

playground/fs-serve/root/src/deny/.deny

@@ -0,0 +1 @@
+.deny

playground/fs-serve/root/src/deny/deny.txt

@@ -0,0 +1 @@
+deny

playground/fs-serve/root/vite.config-deny.js

@@ -0,0 +1,22 @@
+importpathfrom'node:path'
+import{defineConfig}from'vite'
+
+exportdefaultdefineConfig({
+build: {
+rollupOptions: {
+input: {
+main: path.resolve(__dirname,'src/index.html'),
+},
+},
+},
+server: {
+fs: {
+strict: true,
+allow: [path.resolve(__dirname,'src')],
+deny: ['**/deny/**'],
+},
+},
+define: {
+ROOT: JSON.stringify(path.dirname(__dirname).replace(/\\/g,'/')),
+},
+})