marty-media/server
1
0
Fork 0
Code Issues 9 Pull requests 10 Projects Releases 75 Packages Wiki Activity Actions

chore: [security] bump vite from 6.2.6 to 6.2.7 #455

Closed
martinr92 wants to merge 1 commit from dependabot-npm_and_yarn-develop-vite-6.2.7 into develop
pull from: dependabot-npm_and_yarn-develop-vite-6.2.7
merge into: marty-media:develop
Conversation 4 Commits 1 Files changed 2 +8 -8
martinr92 commented 2025-05-01 02:59:45 +00:00 (Migrated from gitlab.com)
Copy link

Bumps vite from 6.2.6 to 6.2.7. This update includes a security fix.

Vulnerabilities fixed

Vite's server.fs.deny bypassed with /. for files under project root

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed.

  • Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
  • Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
</tr></table>

... (truncated)

Patched versions: 4.5.14; 5.4.19; 6.1.6; 6.2.7; 6.3.4 Affected versions: = 6.3.0, <= 6.3.3

Changelog

Sourced from vite's changelog.

6.2.7 (2025-04-30)

Commits

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.2.6 to 6.2.7. **This update includes a security fix.** <details> <summary>Vulnerabilities fixed</summary> <blockquote> <p><strong>Vite's server.fs.deny bypassed with /. for files under project root</strong></p> <h3>Summary</h3> <p>The contents of files in <a href="https://vite.dev/config/shared-options.html#root">the project <code>root</code></a> that are denied by a file matching pattern can be returned to the browser.</p> <h3>Impact</h3> <p>Only apps explicitly exposing the Vite dev server to the network (using --host or <a href="https://vitejs.dev/config/server-options.html#server-host">server.host config option</a>) are affected. Only files that are under <a href="https://vite.dev/config/shared-options.html#root">project <code>root</code></a> and are denied by a file matching pattern can be bypassed.</p> <ul> <li>Examples of file matching patterns: <code>.env</code>, <code>.env.*</code>, <code>*.{crt,pem}</code>, <code>**/.env</code></li> <li>Examples of other patterns: <code>**/.git/**</code>, <code>.git/**</code>, <code>.git/**/*</code></li> </ul> <h3>Details</h3> <p><a href="https://vite.dev/config/server-options.html#server-fs-deny"><code>server.fs.deny</code></a> can contain patterns matching against files (by default it includes <code>.env</code>, <code>.env.*</code>, <code>*.{crt,pem}</code> as such patterns). These patterns were able to bypass for files under <code>root</code> by using a combination of slash and dot (<code>/.</code>).</p> <h3>PoC</h3> <pre><code>npm create vite@latest cd vite-project/ cat &quot;secret&quot; &gt; .env &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> <blockquote> <p>Patched versions: 4.5.14; 5.4.19; 6.1.6; 6.2.7; 6.3.4 Affected versions: <!-- raw HTML omitted -->= 6.3.0, &lt;= 6.3.3</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/v6.2.7/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted -->6.2.7 (2025-04-30)<!-- raw HTML omitted --></h2> <ul> <li>fix: check static serve file inside sirv (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19965">#19965</a>) (<a href="https://github.com/vitejs/vite/commit/99980ecf669aa42379ab0cb0c5889c4b671f4866">99980ec</a>), closes <a href="https://github.com/vitejs/vite/issues/19965">#19965</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/3d6a42728f645bcab7c391983604ecdb3619eca9"><code>3d6a427</code></a> release: v6.2.7</li> <li><a href="https://github.com/vitejs/vite/commit/99980ecf669aa42379ab0cb0c5889c4b671f4866"><code>99980ec</code></a> fix: check static serve file inside sirv (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/19965">#19965</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite/commits/v6.2.7/packages/vite">compare view</a></li> </ul> </details> <br />
martinr92 commented 2025-05-01 02:59:45 +00:00 (Migrated from gitlab.com)
Copy link

assigned to @martinr92

assigned to @martinr92
martinr92 commented 2025-05-01 02:59:49 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !427

mentioned in merge request !427
martinr92 commented 2025-05-01 03:07:52 +00:00 (Migrated from gitlab.com)
Copy link

SonarQube Cloud Code Analysis

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

## SonarQube Cloud Code Analysis ## Quality Gate passed Issues ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0 New issues](https://sonarcloud.io/project/issues?id=marty-media_server&pullRequest=431&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted.svg '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=marty-media_server&pullRequest=431&issueStatuses=ACCEPTED) Measures ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=marty-media_server&pullRequest=431&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=marty-media_server&pullRequest=431&metric=new_coverage&view=list) ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed.svg '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=marty-media_server&pullRequest=431&metric=new_duplicated_lines_density&view=list) [See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=marty-media_server&pullRequest=431)
martinr92 commented 2025-05-15 17:05:38 +00:00 (Migrated from gitlab.com)
Copy link

This merge request has been superseded by !443+

This merge request has been superseded by !443+
martinr92 (Migrated from gitlab.com) closed this pull request 2025-05-15 17:05:38 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

   
confirmed

   
critical

   
dependencies
Pull requests that update a dependency file

  
discussion

   
docker

   
documentation

   
enhancement

   
go

   
javascript

   
security
Pull requests that address a security vulnerability

  
severity:high

   
severity:low

   
severity:moderate

   
suggestion

   
support
No labels
bug
confirmed
critical
dependencies
discussion
docker
documentation
enhancement
go
javascript
security
severity:high
severity:low
severity:moderate
suggestion
support
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
marty-media/server!455
No description provided.