moduleGraph.safeModulesPath entries truncated unconditionally

[dominikg]

Describe the bug

First 4 characters are missing. eg "e_modules/.vite/chunk-TFQY2HEV.js" instead of "/node_modules/.vite/chunk-TFQY2HEV.js"

found via sveltekit sveltejs/kit#3349

@bluwy traced it to

vite/packages/vite/src/node/plugins/importAnalysis.ts

Lines 401 to 404 in 5964949

	// record as safe modules
	server?.moduleGraph.safeModulesPath.add(
	cleanUrl(url).slice(4 /* '/@fs'.length */)
	)

Reproduction

https://github.com/Rich-Harris/vite-safe-modules-repro

System Info

vite 2.7.12 via sveltekit 1.0.0-next.230


  System:
    OS: Linux 5.12 Ubuntu 20.04.3 LTS (Focal Fossa)
    CPU: (12) x64 AMD Ryzen 5 4600H with Radeon Graphics
    Memory: 2.79 GB / 15.07 GB
    Container: Yes
    Shell: 5.0.17 - /bin/bash
  Binaries:
    Node: 16.13.0 - ~/.nvm/versions/node/v16.13.0/bin/node
    Yarn: 1.22.17 - ~/.nvm/versions/node/v16.13.0/bin/yarn
    npm: 8.3.0 - ~/.nvm/versions/node/v16.13.0/bin/npm
  Browsers:
    Chrome: 97.0.4692.71
    Firefox: 96.0

Used Package Manager

pnpm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to https://github.com/vuejs/vue-next instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[dominikg]

Looking into it i found
https://github.com/vitejs/vite/blob/main/packages/vite/src/node/server/middlewares/static.ts#L151-L157

and it looks like ensureLeadingSlash and normalizePath should be called before adding. stripping /@fs/ should also be done on the condition that it exists.