Vite's server.fs.deny bypassed with /. for files under project root
SummaryThe contents of files in [the project `root`](https://vite.dev/config/shared-options.html#root) that are denied by a file matching pattern can be returned to the browser.ImpactOnly apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.
Only files that are under [project `root`](https://vite.dev/config/shared-options.html#root) and are denied by a file matching pattern can be bypassed.Examples of file matching patterns: `.env`, `.env.*`, `*.{crt,pem}`, `**/.env`Examples of other patterns: `**/.git/**`, `.git/**`, `.git/**/*`Details[`server.fs.deny`](https://vite.dev/config/server-options.html#server-fs-deny) can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns).
These patterns were able to bypass for files under `root` by using a combination of slash and dot (`/.`).PoC![image](https://github.com/user-attachments/assets/822f4416-aa42-461f-8c95-a88d155e674b)
![image](https://github.com/user-attachments/assets/42902144-863a-4afb-ac5b-fc16effa37cc)