Vite does not sanitize path leading up to glob before handing it to fast-glob

[dummdidumm]

Describe the bug

import.meta.glob does not work when executing inside a path that has braces, the files to glob are not found because of a missing glob sanitization.

Example:

|- (blog)
  |- post.md
  |- find-posts.js

If I do import.meta.glob('./*.md') the file isn't found. The culprit is the toAbsoluteGlob function in the Vite codebase not sanitizing the path leading up to the glob. That path could contain characters that are special to fast-glob, like (, ), [, ].

This affects SvelteKit users since the layout rework because folders starting with ( and ending with ) like (group) have special meaning now, which means people start using that, and all import.meta.glob invocations inside such folders won't work: sveltejs/kit#6239

Reproduction

https://stackblitz.com/edit/vitejs-vite-brmhvp?file=main.js,(blog)%2Ffind-posts.js,blog%2Ffind-posts.js&terminal=dev

System Info

System:
    OS: Windows 10 10.0.19044
    CPU: (8) x64 11th Gen Intel(R) Core(TM) i7-1185G7 @ 3.00GHz
    Memory: 18.71 GB / 31.85 GB
  Binaries:
    Node: 16.16.0 - C:\Program Files\nodejs\node.EXE
    Yarn: 1.22.19 - ~\AppData\Roaming\npm\yarn.CMD
    npm: 8.11.0 - C:\Program Files\nodejs\npm.CMD
  Browsers:
    Edge: Spartan (44.19041.1266.0), Chromium (104.0.1293.63)
    Internet Explorer: 11.0.19041.1566
  npmPackages:
    vite: ^3.0.9 => 3.0.9

Used Package Manager

pnpm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[dominikg]

The code mentioned is here https://github.com/vitejs/vite/blob/main/packages/vite/src/node/plugins/importMetaGlob.ts#L478-L484

Currently discussing a problem where globs using aliases are making it hard to impossible to tell which part of the resolved path is the glob.

[patak-dev]

fixed by #9842