🔧 fix: normalize path when necessary

Author: SaltyAom

CHANGELOG.md

@@ -1,3 +1,8 @@
+# 1.4.6 - 3 Nov 2025
+Bug fix:
+- normalize path only when unsafe
+- cache `crypto` package import
+
 # 1.4.5 - 1 Nov 2025
 Bug fix:
 - [#52](https://github.com/elysiajs/elysia-static/pull/52) resolve static paths correctly on Windows

package.json

@@ -1,6 +1,6 @@
 {
     "name": "@elysiajs/static",
-    "version": "1.4.5",
+    "version": "1.4.6",
     "license": "MIT",
     "scripts": {
         "dev": "bun run --watch example/index.ts",

src/index.ts

@@ -49,6 +49,11 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
     if (!builtinModule) return new Elysia()
 
     const [fs, path] = builtinModule
+    const isUnsafeSep = path.sep !== '/'
+
+    const normalizePath = isUnsafeSep
+        ? (p: string) => p.replace(/\\/g, '/')
+        : (p: string) => p
 
     const fileCache = new LRUCache<string, Response>()
 
@@ -79,24 +84,25 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
                 if (decodeURI)
                     relativePath = fastDecodeURI(relativePath) ?? relativePath
 
-                let pathName = path.join(prefix, relativePath)
+                let pathName = normalizePath(path.join(prefix, relativePath))
 
                 if (isBun && absolutePath.endsWith('.html')) {
                     const htmlBundle = await import(absolutePath)
-                    const normalizedPath = pathName.replace(/\\/g, '/')
 
-                    app.get(normalizedPath, htmlBundle.default)
-                    if (indexHTML && normalizedPath.endsWith('/index.html'))
+                    app.get(pathName, htmlBundle.default)
+                    if (indexHTML && pathName.endsWith('/index.html'))
                         app.get(
-                            normalizedPath.replace('/index.html', ''),
+                            pathName.replace('/index.html', ''),
                             htmlBundle.default
                         )
 
                     continue
                 }
 
                 if (!extension)
-                    pathName = pathName.slice(0, pathName.lastIndexOf('.'))
+                    pathName = normalizePath(
+                        pathName.slice(0, pathName.lastIndexOf('.'))
+                    )
 
                 const file: Awaited<ReturnType<typeof getFile>> = isBun
                     ? getFile(absolutePath)
@@ -182,9 +188,8 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
 
                     return response.clone()
                 }
-                const normalizedPath = pathName.replace(/\\/g, '/')
                 app.get(
-                    normalizedPath,
+                    pathName,
                     useETag
                         ? (handleCache as any)
                         : new Response(
@@ -197,9 +202,9 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
                           )
                 )
 
-                if (indexHTML && normalizedPath.endsWith('/index.html'))
+                if (indexHTML && pathName.endsWith('/index.html'))
                     app.get(
-                        normalizedPath.replace('/index.html', ''),
+                        pathName.replace('/index.html', ''),
                         useETag
                             ? (handleCache as any)
                             : new Response(
@@ -227,14 +232,13 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
                 if (!absolutePath || shouldIgnore(absolutePath)) continue
 
                 let relativePath = absolutePath.replace(assetsDir, '')
-                const pathName = path.join(prefix, relativePath)
-                const normalizedPath = pathName.replace(/\\/g, '/')
+                const pathName = normalizePath(path.join(prefix, relativePath))
                 const htmlBundle = await import(absolutePath)
 
-                app.get(normalizedPath, htmlBundle.default)
-                if (indexHTML && normalizedPath.endsWith('/index.html'))
+                app.get(pathName, htmlBundle.default)
+                if (indexHTML && pathName.endsWith('/index.html'))
                     app.get(
-                        normalizedPath.replace('/index.html', ''),
+                        pathName.replace('/index.html', ''),
                         htmlBundle.default
                     )
             }
@@ -243,11 +247,13 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
         app.onError(() => {}).get(
             `${prefix}/*`,
             async ({ params, headers: requestHeaders }) => {
-                const pathName = path.join(
-                    assets,
-                    decodeURI
-                        ? fastDecodeURI(params['*']) ?? params['*']
-                        : params['*']
+                const pathName = normalizePath(
+                    path.join(
+                        assets,
+                        decodeURI
+                            ? (fastDecodeURI(params['*']) ?? params['*'])
+                            : params['*']
+                    )
                 )
 
                 if (shouldIgnore(pathName)) throw new NotFoundError()

src/utils.ts

@@ -204,8 +204,8 @@ export async function generateETag(file: BunFile | Buffer<ArrayBufferLike>) {
             .update(await (file as BunFile).arrayBuffer())
             .digest('base64')
 
-    if (!crypto) Crypto = process.getBuiltinModule('crypto')
-    if (!crypto)
+    if (!Crypto) Crypto = process.getBuiltinModule('crypto')
+    if (!Crypto)
         return void console.warn(
             '[@elysiajs/static] crypto is required to generate etag.'
         )