From 236660a494ca18f8cced49a3b1f66ca763051272 Mon Sep 17 00:00:00 2001
From: sapphi-red <green@sapphi.red>
Date: Mon, 27 Jun 2022 12:25:49 +0900
Subject: [PATCH] fix: /@fs/ dir traversal with escaped chars (static)

---
 .../fs-serve/__tests__/fs-serve.spec.ts           |  7 +++++++
 packages/playground/fs-serve/root/src/index.html  | 15 +++++++++++++++
 .../vite/src/node/server/middlewares/static.ts    |  2 +-
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
index 25c55c8a206920..77940b40b3aebd 100644
--- a/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
+++ b/packages/playground/fs-serve/__tests__/fs-serve.spec.ts
@@ -37,6 +37,13 @@ describe('main', () => {
       expect(await page.textContent('.unsafe-fetch-status')).toBe('403')
     })
 
+    test('unsafe fetch with special characters (#8498)', async () => {
+      expect(await page.textContent('.unsafe-fetch-8498')).toMatch(
+        '403 Restricted'
+      )
+      expect(await page.textContent('.unsafe-fetch-8498-status')).toBe('403')
+    })
+
     test('safe fs fetch', async () => {
       expect(await page.textContent('.safe-fs-fetch')).toBe(stringified)
       expect(await page.textContent('.safe-fs-fetch-status')).toBe('200')
diff --git a/packages/playground/fs-serve/root/src/index.html b/packages/playground/fs-serve/root/src/index.html
index a0240bf7c89bba..6939e0f4b09ed9 100644
--- a/packages/playground/fs-serve/root/src/index.html
+++ b/packages/playground/fs-serve/root/src/index.html
@@ -17,6 +17,8 @@ <h2>Safe Fetch Subdirectory</h2>
 <h2>Unsafe Fetch</h2>
 <pre class="unsafe-fetch-status"></pre>
 <pre class="unsafe-fetch"></pre>
+<pre class="unsafe-fetch-8498-status"></pre>
+<pre class="unsafe-fetch-8498"></pre>
 
 <h2>Safe /@fs/ Fetch</h2>
 <pre class="safe-fs-fetch-status"></pre>
@@ -85,6 +87,19 @@ <h2>Denied</h2>
       console.error(e)
     })
 
+  // outside of allowed dir with special characters #8498
+  fetch('/src/%2e%2e%2funsafe%2etxt')
+    .then((r) => {
+      text('.unsafe-fetch-8498-status', r.status)
+      return r.text()
+    })
+    .then((data) => {
+      text('.unsafe-fetch-8498', data)
+    })
+    .catch((e) => {
+      console.error(e)
+    })
+
   // imported before, should be treated as safe
   fetch('/@fs/' + ROOT + '/safe.json')
     .then((r) => {
diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts
index 72e37297246e1f..659dfbae62ecfe 100644
--- a/packages/vite/src/node/server/middlewares/static.ts
+++ b/packages/vite/src/node/server/middlewares/static.ts
@@ -78,7 +78,7 @@ export function serveStaticMiddleware(
       return next()
     }
 
-    const url = decodeURI(req.url!)
+    const url = decodeURIComponent(req.url!)
 
     // apply aliases to static requests as well
     let redirected: string | undefined