@@ -48,6 +48,11 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
4848 if ( ! builtinModule ) return new Elysia ( )
4949
5050 const [ fs , path ] = builtinModule
51+ const isUnsafeSep = path . sep !== '/'
52+
53+ const normalizePath = isUnsafeSep
54+ ? ( p : string ) => p . replace ( / \\ / g, '/' )
55+ : ( p : string ) => p
5156
5257 const fileCache = new LRUCache < string , Response > ( )
5358
@@ -78,7 +83,7 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
7883 if ( decodeURI )
7984 relativePath = fastDecodeURI ( relativePath ) ?? relativePath
8085
81- let pathName = path . join ( prefix , relativePath )
86+ let pathName = normalizePath ( path . join ( prefix , relativePath ) )
8287
8388 if ( isBun && absolutePath . endsWith ( '.html' ) ) {
8489 const htmlBundle = await import ( absolutePath )
@@ -94,7 +99,9 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
9499 }
95100
96101 if ( ! extension )
97- pathName = pathName . slice ( 0 , pathName . lastIndexOf ( '.' ) )
102+ pathName = normalizePath (
103+ pathName . slice ( 0 , pathName . lastIndexOf ( '.' ) )
104+ )
98105
99106 const file : Awaited < ReturnType < typeof getFile > > = isBun
100107 ? getFile ( absolutePath )
@@ -180,7 +187,6 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
180187
181188 return response . clone ( )
182189 }
183-
184190 app . get (
185191 pathName ,
186192 useETag
@@ -225,8 +231,7 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
225231 if ( ! absolutePath || shouldIgnore ( absolutePath ) ) continue
226232
227233 let relativePath = absolutePath . replace ( assetsDir , '' )
228- const pathName = path . join ( prefix , relativePath )
229-
234+ const pathName = normalizePath ( path . join ( prefix , relativePath ) )
230235 const htmlBundle = await import ( absolutePath )
231236
232237 app . get ( pathName , htmlBundle . default )
@@ -239,25 +244,25 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
239244 }
240245
241246 const serveStaticFile = async ( pathName : string , requestHeaders ?: Record < string , string | undefined > ) => {
242- // Normalize for ignore matching
243- const rel = pathName . startsWith ( assetsDir )
244- ? pathName . slice ( assetsDir . length )
245- : pathName
247+ const normalizedPath = normalizePath ( pathName )
248+ const rel = normalizedPath . startsWith ( assetsDir )
249+ ? normalizedPath . slice ( assetsDir . length )
250+ : normalizedPath
246251 if ( shouldIgnore ( rel ) ) return null
247252
248- const cache = fileCache . get ( pathName )
253+ const cache = fileCache . get ( normalizedPath )
249254 if ( cache ) return cache . clone ( )
250255
251- const fileStat = await fs . stat ( pathName ) . catch ( ( ) => null )
256+ const fileStat = await fs . stat ( normalizedPath ) . catch ( ( ) => null )
252257 if ( ! fileStat ) return null
253258
254259 if ( ! indexHTML && fileStat . isDirectory ( ) ) return null
255260
256261 let file : NonNullable < Awaited < ReturnType < typeof getFile > > > | undefined
257- let targetPath = pathName
262+ let targetPath = normalizedPath
258263
259264 if ( ! isBun && indexHTML ) {
260- const htmlPath = path . join ( pathName , 'index.html' )
265+ const htmlPath = path . join ( normalizedPath , 'index.html' )
261266 const cache = fileCache . get ( htmlPath )
262267 if ( cache ) return cache . clone ( )
263268
@@ -267,8 +272,8 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
267272 }
268273 }
269274
270- if ( ! file && ! fileStat . isDirectory ( ) && ( await fileExists ( pathName ) ) )
271- file = await getFile ( pathName )
275+ if ( ! file && ! fileStat . isDirectory ( ) && ( await fileExists ( normalizedPath ) ) )
276+ file = await getFile ( normalizedPath )
272277
273278 if ( ! file ) return null
274279
@@ -299,7 +304,7 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
299304 )
300305 } )
301306
302- fileCache . set ( pathName , response )
307+ fileCache . set ( normalizedPath , response )
303308 return response . clone ( )
304309 }
305310
0 commit comments