Fix security vulnerabilities

dist/functions/server/bunext-req-handler.js

@@ -9,15 +9,16 @@ import checkExcludedPatterns from "../../utils/check-excluded-patterns";
 import { AppData } from "../../data/app-data";
 import { log } from "../../utils/log";
 import fullRebuild from "./full-rebuild";
+import grabRouter from "../../utils/grab-router";
 const HMR_RETRY_COOLDOWN_MS = 5000;
 let lastHmrRetryTime = 0;
 export default async function bunextRequestHandler({ req: initial_req, server, }) {
     const is_dev = isDevelopment();
     let req = initial_req.clone();
     try {
-        const url = new URL(req.url);
+        let url = new URL(req.url);
         if (checkExcludedPatterns({ path: url.pathname })) {
-            return Response.json({ success: false, msg: `Invalid Path` });
+            return Response.json({ success: false, msg: `Invalid Path` }, { status: 404 });
         }
         let response = undefined;
         if (global.BUNEXT_CONSTANTS.config?.middleware) {
@@ -30,6 +31,7 @@ export default async function bunextRequestHandler({ req: initial_req, server, }
             }
             if (middleware_res instanceof Request) {
                 req = middleware_res;
+                url = new URL(req.url);
             }
         }
         if (is_dev && url.pathname == AppData["BunextHMRRetryRoute"]) {
@@ -53,8 +55,13 @@ export default async function bunextRequestHandler({ req: initial_req, server, }
         else if (url.pathname.startsWith("/public/")) {
             response = await handlePublic({ req });
         }
-        else if (url.pathname.match(/\..*$/)) {
+        else if (url.pathname.match(/\.[^/]+$/)) {
             response = await handleFiles({ req });
+            // Paths like `/users/john.doe` look like files but can be pages.
+            if (response.status == 404 &&
+                grabRouter()?.match(url.pathname)?.filePath) {
+                response = await handleWebPages({ req });
+            }
         }
         else {
             response = await handleWebPages({ req });