tbenandClaude Opus 5.5
74103a19c9
- Move page cache out of the publicly served .bunext/public dir and hash cache keys - Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries - Enforce API body size limit while reading; keep req body readable for handlers - Hide error messages from clients in production - Escape inline script JSON; strip cookies from HMR payloads - Only trust X-Forwarded-Proto with trust_proxy config - Fix console race in SSR, dotted page paths, middleware rewrites, excluded path status, encoded static file names, symlinked dirs - Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code Co-Authored-By: Claude Opus 5.5 <[email protected]>
43 lines
1.2 KiB
TypeScript
43 lines
1.2 KiB
TypeScript
import grabDirNames from "../../utils/grab-dir-names";
|
|
import path from "path";
|
|
import isDevelopment from "../../utils/is-development";
|
|
import { existsSync } from "fs";
|
|
import isSafePath from "../../utils/is-safe-path";
|
|
|
|
const { PUBLIC_DIR } = grabDirNames();
|
|
|
|
type Params = {
|
|
req: Request;
|
|
};
|
|
|
|
export default async function ({ req }: Params): Promise<Response> {
|
|
try {
|
|
const is_dev = isDevelopment();
|
|
const url = new URL(req.url);
|
|
const file_path = path.join(PUBLIC_DIR, decodeURIComponent(url.pathname));
|
|
|
|
if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
|
|
return new Response("Forbidden", { status: 403 });
|
|
}
|
|
|
|
if (!existsSync(file_path)) {
|
|
return new Response(`File Doesn't Exist`, {
|
|
status: 404,
|
|
});
|
|
}
|
|
|
|
const file = Bun.file(file_path);
|
|
const headers = new Headers();
|
|
|
|
if (!is_dev) {
|
|
headers.set("Cache-Control", "public, max-age=3600");
|
|
}
|
|
|
|
return new Response(file, { headers });
|
|
} catch (error) {
|
|
return new Response(`File Not Found`, {
|
|
status: 404,
|
|
});
|
|
}
|
|
}
|