tbenandClaude Opus 5.5
96e392f556
- Server functions can return not_found: true to render the 404 page with status 404. - Page components and window.__PAGE_PROPS__ (and HMR updates) only get props, query, url and error. response_options, redirect, cache settings and res_transform stay on the server, so cookies and private headers no longer end up in the HTML. BunextPageProps is narrowed to match (breaking for code that read server-only fields from component props). - response_options headers go through a Headers object, so repeated headers such as several Set-Cookie survive. - Redirects: status_code wins over permanent; response_options headers and res_transform apply to redirects too. - Gzip for compressible text responses; compress: false to turn it off. - Files the router matches but never bundles (.server.ts, __root, excluded paths and directories) return 404 instead of looping through dev rebuild retries. - Missing public files return 404 rather than 403, so dotted page paths like /users/john.doe fall through to pages again. - importFresh detects rewrites within the filesystem's mtime granularity. - README: self-hosted React (not esm.sh), snake_case option names, static file serving, cache headers, the new options. Co-Authored-By: Claude Opus 5.5 <[email protected]>
32 lines
1.1 KiB
JavaScript
32 lines
1.1 KiB
JavaScript
import { existsSync, statSync } from "fs";
|
|
import path from "path";
|
|
import isSafePath from "./is-safe-path";
|
|
/**
|
|
* Maps a URL path onto a file in `dir`, in this order:
|
|
* - `..` segments (encoded or not) are resolved against `/`, so they
|
|
* can never climb above `dir`; the 403 check is a second guard
|
|
* - 404 if there is no such file (so callers can fall through to pages)
|
|
* - 403 if a symlink points outside `dir`
|
|
*/
|
|
export default function resolvePublicFile(dir, url_path) {
|
|
let decoded;
|
|
try {
|
|
decoded = decodeURIComponent(url_path);
|
|
}
|
|
catch {
|
|
return { status: 404 };
|
|
}
|
|
const root = path.resolve(dir);
|
|
const file_path = path.resolve(root, "." + path.posix.join("/", decoded));
|
|
if (file_path !== root && !file_path.startsWith(root + path.sep)) {
|
|
return { status: 403 };
|
|
}
|
|
if (!existsSync(file_path) || !statSync(file_path).isFile()) {
|
|
return { status: 404 };
|
|
}
|
|
if (!isSafePath({ filePath: file_path, allowedDir: root })) {
|
|
return { status: 403 };
|
|
}
|
|
return { status: 200, file_path };
|
|
}
|