From 8f74ce4ff3c159c7f797ab024200d7893a29fbfe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=BF=A0=20/=20green?= Date: Tue, 5 Mar 2024 17:09:59 +0900 Subject: [PATCH] fix: escape single quote when relative base is used (#16060) --- packages/vite/src/node/build.ts | 16 ++++++++++------ playground/assets/index.html | 8 ++++++++ playground/assets/nested/with-single'quote.png | Bin 0 -> 4972 bytes 3 files changed, 18 insertions(+), 6 deletions(-) create mode 100644 playground/assets/nested/with-single'quote.png diff --git a/packages/vite/src/node/build.ts b/packages/vite/src/node/build.ts index a6888e97ffe5a7..b093ecfb5e213a 100644 --- a/packages/vite/src/node/build.ts +++ b/packages/vite/src/node/build.ts @@ -1070,7 +1070,7 @@ function injectSsrFlag>( /* The following functions are copied from rollup - https://github.com/rollup/rollup/blob/0bcf0a672ac087ff2eb88fbba45ec62389a4f45f/src/ast/nodes/MetaProperty.ts#L145-L193 + https://github.com/rollup/rollup/blob/ce6cb93098850a46fa242e37b74a919e99a5de28/src/ast/nodes/MetaProperty.ts#L155-L203 https://github.com/rollup/rollup The MIT License (MIT) @@ -1101,7 +1101,7 @@ const getFileUrlFromFullPath = (path: string) => `require('u' + 'rl').pathToFileURL(${path}).href` const getFileUrlFromRelativePath = (path: string) => - getFileUrlFromFullPath(`__dirname + '/${path}'`) + getFileUrlFromFullPath(`__dirname + '/${escapeId(path)}'`) const relativeUrlMechanisms: Record< InternalModuleFormat, @@ -1109,16 +1109,20 @@ const relativeUrlMechanisms: Record< > = { amd: (relativePath) => { if (relativePath[0] !== '.') relativePath = './' + relativePath - return getResolveUrl(`require.toUrl('${relativePath}'), document.baseURI`) + return getResolveUrl( + `require.toUrl('${escapeId(relativePath)}'), document.baseURI`, + ) }, cjs: (relativePath) => `(typeof document === 'undefined' ? ${getFileUrlFromRelativePath( relativePath, )} : ${getRelativeUrlFromDocument(relativePath)})`, - es: (relativePath) => getResolveUrl(`'${relativePath}', import.meta.url`), + es: (relativePath) => + getResolveUrl(`'${escapeId(relativePath)}', import.meta.url`), iife: (relativePath) => getRelativeUrlFromDocument(relativePath), // NOTE: make sure rollup generate `module` params - system: (relativePath) => getResolveUrl(`'${relativePath}', module.meta.url`), + system: (relativePath) => + getResolveUrl(`'${escapeId(relativePath)}', module.meta.url`), umd: (relativePath) => `(typeof document === 'undefined' && typeof location === 'undefined' ? ${getFileUrlFromRelativePath( relativePath, @@ -1129,7 +1133,7 @@ const relativeUrlMechanisms: Record< const customRelativeUrlMechanisms = { ...relativeUrlMechanisms, 'worker-iife': (relativePath) => - getResolveUrl(`'${relativePath}', self.location.href`), + getResolveUrl(`'${escapeId(relativePath)}', self.location.href`), } as const satisfies Record string> export type RenderBuiltAssetUrl = ( diff --git a/playground/assets/index.html b/playground/assets/index.html index dd013828cc96b0..7230c09c1d09ee 100644 --- a/playground/assets/index.html +++ b/playground/assets/index.html @@ -138,6 +138,11 @@

Unicode URL

+

Filename including single quote

+
+ +
+

encodeURI for the address

assets in noscript import unicodeUrl from './テスト-測試-white space.js?url' text('.unicode-url', unicodeUrl) + import filenameIncludingSingleQuoteUrl from "./nested/with-single'quote.png" + text('.filename-including-single-quote', filenameIncludingSingleQuoteUrl) + import cssUrl from './css/icons.css?url' text('.url-css', cssUrl) diff --git a/playground/assets/nested/with-single'quote.png b/playground/assets/nested/with-single'quote.png new file mode 100644 index 0000000000000000000000000000000000000000..cb1c88d48c090ab78b2836296dbe54a092e86611 GIT binary patch literal 4972 zcmZ`*1z1#D*FGR!f*@TE(lK-nNDm?1puhkF3>_m3Fd!&`Ac%Acf`rnI(xHTaB0Y3T zNh(MR{G;CQ-uwLD|DW@mv({c~z3bg;?epxjqx5y5D3=-PLKHewa8f!H|@xHPy!lRjVJ zX^Ga-z$NB|U%6G`yN=@L#2)58=NuaP^9KsukVH*O zi%XfFaml;8i|dSTg-h&^{`6F)CR#xQIjZ4__&yFf@L%l zEP_mvaxu(XH|q;{`8lM+d5k#oH4$5QEYO}90I}c$9GFxG`xak;LV96D(;9eo#GNHn zhYL?oxZ&|{ZA~2=$EB~{aErib$IIKX59nTG4vyYG)-yd_`(~I7v6u*72=4Mh5P<1^ zwsDH7h+Kb%$KVhzAdH)y-g_~tJxF3&eKWv%o#qKX^&z!@A)dOPh|Nx-a2Ia2XQhvO zck?q|U8*zR2}#}vgIIo%OX1B2Cd70m#;CrpQw5U zGVKBa9rkKt;|#$@syzF2TDZ-xmQVRz2a_(#tVPTkB&}$!zb?&^%4*Z^Oh4p}Gg{@M zJU!K!R^{I=n4Ie~AC3_&Xc6X6EJ|Hd<(qKii1ZC~PxHAtf>MGRk)gxbh?Ep)9}^t5 zQ($oEC@B={y%2{e5e19kJL%FUNgtQkrF46jw2sGX%>5+&>VcT~`41f5B<+^0l?RMQ z8cXGS4MO5((i0GOeHeg`j{s*#+Bm~DZm1=oXe4KIqd$E#x92{+BA#(OkfBINk1J;T z$YBj{CX_D0o016MfSpwU56zC7u1Js)x?)StgV$v%h9TkW@X#kce5kTO*vYtyhlP!HZNhit+lllN9<$y3|i{lnsbq(X*Hy7!@?W>O%B`I96?BNTBxm6gkV|r|SDdPlou1m_8@3pRaQr$Q%eF!GZMW(|iP07hc;6@4AKE>IeX`%NJr&ulG8dqBjlS1SV7FX_z`!x&m@JIC8&f^$ zbR~zm zOh{6WmN3`bYs$p9%0e(|*wx%*udL5{^qj?1I#E0CdF&Xy$*Ue<6d`(ORkSuJo=ih1 z-zy=lHp5s+_I9JjSI%J2NH47en-9oBX-;Df>cKJ3-BzH_!$kwu!sX1YjyHtLXa^{t zyjC`=GF>btGBzzTE)p-AF%D4U)Q>G<{;KT4TK7CKDKJYmUrS%Y;D^CVQMqxMp?vvN zne0n-vlb^u>_y z@@mXgMlp$I@o+{p##lywaRt|E@pJJJ32pIA2{zZ7O|DJZe9*WVC&&IG( zs!wk`>O&-^o&7qu5++${+9su^957o|0nXYrs1}Sv4PLq zT~2ijE3H@dFJ^PhdY3QD_W1Qw=zh`_eMRs}$%$j_<{HbVSvLZ?n3k~MA^hc~?draj z@P2MH?g_UEj`I7B77YbWEM81$_OeiEr@`k6{#X37gX)6f2>UrcEJNd1^@8=XonqIF zz$)Od3G0eAW?x;#HTJdSH?eO9&eDzu+00&CS8#9TnFr=U^SZY(Y-()^=Be*rxir2E zyj%o&Lg6^>VQK9P?FsE3)vKdbxU2}1c~2p@ivCZ_u~+R<>;n^-47 zNG7!)vrfE3+l5y!=}^G$Zu7lwl>+AVW)vUjdabG%H1d!pu)<^Aq0HrYqvU;W&4GkG z?XeWC6zh+5y?0-nK?ZN_zJjmAf5Nx>f23Ae%r!lzc^SxAD;fYl<9laNNo;EPt@mh;o?&9>{r z(L!|7G^up=C)?+}P6(&j_(JHX)2gd{6GsZ~W>#f#X6~k-QntV*{2%$Zr$zm>jTlNw zUvJHht671Q<&t*i)MpAY<3?15L)Ej+XRF&bd}_)5#myy*{?5DRZOiX;J3eJLHTy|y zjZfZfKHHC5V%s$#G?p4m8%>(9bM-1x@mBy#p7u%A4YsqC(AqwefMbHHlKZW-yDhBp;6>He=aJq~7rW}{~1kMNEN zcARGJpR=!ZtiKzJ6OM~!Em07<|MEP4Rce2pG3a@q?&0a7bui<}0gSC}cV+kceA@vX zBoD%Wzx=4#qupcSea_`VEZx4%L0eKQGYj8OmF+l|iUI5M@2@6am_;r}oZ0kS$F)rE zneK15`cv#qK|9s6n+MUiPIK4uR(sB0U|z^7^n`>cG=3r7(e5(auPB>;&?e8=&&-tg z-Jvb@uE+niV)D2OjTppKTI{an0jV<6SW69WGEW;VHUH0S5g5Q3FBy zp;mr@+E1f+e-8v5X zpn#Vn=wDsIMmP2lFlL&biVR26h3;SO6mbV#w2d9_GQ>D702eZHp>4otH)irEX7o+$ zv6$FP!@?H;t|5OtICG9{D6G*AZm#L5qXY0^bs_*4=NfPYtKnd8AQA!K{ni113o8NO zNNEkcH-Oa;S79|h*9U+U=f0@A`_TM2$S9y@R zjy}7Jrw^Q6Qb<@x7^FbL&dv_;ad4D1R8{{AjvdK^oRLT`Suoh&-(SdIOvuy62`nNb zBLfx|1&fLbVj~2713Zv0l%R(%$Dbts$)gJQwf8}IArYP)?7#BD>^$!wru!xW_`2T_-5sv>4?3d>c>~~#%=pet6$?79ea5oE8ggdsY z*r_RqOGAFM{FmdOdHw;K_`-cuJl(N4q{2U|@)!8u&i@Vk&1n7)qol;Y8UN+@7w}gB zvU)xUEE()q2Ngsh;QzAy6%PUbYVW_={bwzITd|9&Kmq~({b4AOund3Q0|0zwO;sgh zXO-==fZN7U=AJfNjmOUkc%ae`EiIi#aqD&R%Q8~5^-H1sRL0FpRK>a13`g$gTfU~% zC)UEp88W4=tzR+>n=CPLp^bR6TE-^vDv;& zt}R_^pX>|nXK%8iQN#h)J^U8UyGovhW}h=huVaUgQakgzNe^;!VZ9EbGY$K6Q&ZDJ zlau&X(`E}>U&0$IKB?J;-WnJfSa3Hy{|9Yh33o33I~sL_)$9& zwU@&bZ!km?=A>yj%o;5o`XgVKk&*FBxkpWMn+$cP6$aX~8$4csf9 zZ8grFClV5M$Zl0g%j&noF;|7cj3_b+iVvxe1kC2RktbRwpFdO9xkOkdZWTUBMdzUP zQL0Hlhw`AK#TgeDAt!|&t&%5%M}mWcM^C|DZ$EwdwC|1EtimGeRW^lu(~kz3<&kY4 zj44o(e!43!o+o4^ibzR8534xL880?CNq#ny6e}{mADs#5$BMASh^} zD;giaSXooIV#$}1Li;$%LXS${&?i1gdZOYoqU8fG4NfFQf&HSgO>`}E)Zs_jbbe?u zj9&wxj(NLTTwJ1AR9IC++$o(;bSy4{!=DmqC@!z6Y`HI3b6y(AHJ=J)GgR*TmSL@*^qxBVDgCrVdEf;^O$JRrfRNj)P< zqxmIINO>2!W9Kyy-P;+AhMng;?p?iuXS9chhZ>rit196JcY{e~di1>HSyXjS3DFuP z(s$7jNsiCu&*XVwvkdf#E_@9QJ&PMBvJ-`cg}noi0g2^>4)LEBX3%)Q#~Enf4%~rs zvCPd9v;LD@ViS`wY5yI_guwOrpozH6567q=`wvS;yoT*xmzL~!ahH~Dh0<=+rtN`fjICF=4?)de=nm;_R~Z(EaM)=~_TLrKZ!F$)X&ME%m%bj-}*b*>X$WyI?0 z>c_J3v7nsFb@9G_exBi&HIIzRfxf_k>hE;L2F;~;FG1fjDpSR!q~5hBayxr?D8XP< z85tQH0%}t$tE+ozXAb!u8G6@g?B-j+ZyhVrqQ8q`Fql1azJyk?N(6*MjFf@F!gwEz znF#yRqS*{JzA<*QKjR0JdwW+H4sNd3x=UUb7K8?XcvZ}5Q2QqSU?*+wTpIm)wgDAtP2u-!`QrX{#G7+t`aQ=kW){yLK z3JMA@Z|{@?s?AGv{zNc#JNTgn{b!^4&%T8szKwecRKVUR=`xo~|N8Z6s_CkhE89N! EADZ_2DgXcg literal 0 HcmV?d00001