Potential fix for code scanning alert no. 26: Uncontrolled data used in path expression

[Tanker187]

Potential fix for https://github.com/Tanker187/vite/security/code-scanning/26

In general, untrusted URL data must not be used directly in filesystem paths. For paths that may contain directory components, the usual fix is:

1. Resolve the user-supplied part relative to a trusted root using path.resolve.
2. Optionally pass this through fs.realpathSync to resolve symlinks.
3. Verify the final normalized path is still within the root, using a robust check like startsWith on normalized absolute paths.
4. Reject or ignore the request if the check fails.

In this specific code, most of this is already implemented, but the intent can be made clearer and slightly safer. The main risk is in the else branch for non-FS_PREFIX URLs, where filePath is constructed from decodeURIComponent(url) and then normalized. We should:

• Explicitly treat root as an absolute base, and resolve the URL path against it using path.resolve(root, decodedUrlPathWithoutQueryAndHash). The existing path.join(root, decodeURIComponent(url)) followed by path.resolve works, but using root directly as the first argument to resolve is clearer and avoids relying on any implicit path state.
• Ensure we always normalize and check the path after realpathSync.native resolution, which is already done.
• Keep the invariant that filePath is a normalized absolute path before calling isParentDirectory, matching that helper’s contract.
• Slightly tighten the root check by ensuring root is normalized once and reused, preventing discrepancies between how root and filePath are normalized.

Given the constraints (only touching shown snippets, no new dependencies), the minimally invasive but clear fix is to adjust the filePath computation block in packages/vite/src/node/server/middlewares/indexHtml.ts to:

• Build filePath via path.resolve(root, decodeURIComponent(url)) instead of path.resolve(path.join(root, ...)).
• Keep the existing realpathSync.native call and isParentDirectory check, but ensure the comment matches the behavior.

These changes keep existing functionality (mapping /something.html under the dev/preview root) while reinforcing that paths cannot escape the root.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.