Skip to content

Dependabot Alert: Vite's server.fs.deny bypassed with /. for files under project root #513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JennaySDavis opened this issue May 8, 2025 · 1 comment

Comments

@JennaySDavis
Copy link
Contributor

Summary
The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
Only files that are under project root and are denied by a file matching pattern can be bypassed.

Examples of file matching patterns: .env, .env.*, .{crt,pem}, /.env
Examples of other patterns: /.git/, .git/
, .git/**/

@JennaySDavis
Copy link
Contributor Author

513 Acceptance Criteria

Pass/Fail Description
Pass Regression Testing of 889 Representations Search

Comments/Additional Notes
N/A

ADA Compliance (Automated scan via Chrome Lighthouse)

Criteria Score
Performance 97
Accessibility 100
Best Practices 100

Passed 05/27/2025 - JSD

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant