fix: stop considering parent URLs as public file (#11145)

vitejs · Dec 23, 2022 · 568a014 · 568a014
1 parent b9511f1
commit 568a014
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/packages/vite/src/node/plugins/asset.ts b/packages/vite/src/node/plugins/asset.ts
@@ -210,6 +210,10 @@ export function checkPublicFile(
     return
   }
   const publicFile = path.join(publicDir, cleanUrl(url))
+  if (!publicFile.startsWith(publicDir)) {
+    // can happen if URL starts with '../'
+    return
+  }
   if (fs.existsSync(publicFile)) {
     return publicFile
   } else {