Strip query parameters from request URL in preview server

packages/cli/src/__tests__/utils.test.ts

@@ -1,4 +1,7 @@
-import { slash } from '../utils';
+import { isSubdir, slash } from '../utils';
+
+jest.mock("os");
+
 
 describe('slash path', () => {
   it('can correctly slash path', () => {
@@ -17,3 +20,42 @@ describe('slash path', () => {
     expect(slash(extended)).toBe(extended);
   });
 });
+
+describe('isSubdir', () => {
+  it('can correctly determine if subdir', () => {
+    (
+      [
+        ['/foo', '/foo', false],
+        ['/foo', '/bar', false],
+        ['/foo', '/foobar', false],
+        ['/foo', '/foo/bar', true],
+        ['/foo', '/foo/../bar', false],
+        ['/foo', '/foo/./bar', true],
+        ['/bar/../foo', '/foo/bar', true],
+        ['/foo', './bar', false],
+        ['/foo', '/foo/..bar', true],
+      ] as [string, string, boolean][]
+    ).forEach(([parent, child, expectRes]) => {
+      expect(isSubdir(parent, child)).toBe(expectRes);
+    });
+  });
+
+  it('can correctly determine if subdir for windows-based paths', () => {
+    const os = require('os');
+    os.platform.mockImplementation(() => 'win32');
+
+    (
+      [
+        ['C:/Foo', 'C:/Foo/Bar', true],
+        ['C:\\Foo', 'C:\\Bar', false],
+        ['C:\\Foo', 'D:\\Foo\\Bar', false],
+      ] as [string, string, boolean][]
+    ).forEach(([parent, child, expectRes]) => {
+      expect(isSubdir(parent, child)).toBe(expectRes);
+    });
+  });
+
+  afterEach(() => {
+    jest.resetModules()
+  })
+});

packages/cli/src/commands/preview-docs/preview-server/preview-server.ts

@@ -6,6 +6,7 @@ import * as path from 'path';
 
 import { startHttpServer, startWsServer, respondWithGzip, mimeTypes } from './server';
 import type { IncomingMessage } from 'http';
+import { isSubdir } from '../../../utils';
 
 function getPageHTML(
   htmlTemplate: string,
@@ -104,6 +105,12 @@ export default async function startPreviewServer(
         }[request.url || ''] ||
         path.resolve(htmlTemplate ? path.dirname(htmlTemplate) : process.cwd(), `.${request.url}`);
 
+      if (!isSubdir(process.cwd(), filePath)) {
+        respondWithGzip('404 Not Found', request, response, { 'Content-Type': 'text/html' }, 404);
+        console.timeEnd(colorette.dim(`GET ${request.url}`));
+        return;
+      }
+
       const extname = String(path.extname(filePath)).toLowerCase() as keyof typeof mimeTypes;
 
       const contentType = mimeTypes[extname] || 'application/octet-stream';

packages/cli/src/utils.ts

@@ -290,4 +290,12 @@ export function slash(path: string): string {
   }
 
   return path.replace(/\\/g, '/');
+}
+
+/**
+ * Checks if dir is subdir of parent
+ */
+export function isSubdir(parent: string, dir: string): boolean {
+  const relative = path.relative(parent, dir);
+  return !!relative && !/^..($|\/)/.test(relative) && !path.isAbsolute(relative);
 }