fix(server): stop serving siblings that share the cwd prefix - #2104

Fixes #2016.

With unsafe_file_serving off, the dev server should only serve files inside cwd or behind a configured route. serveStaticFile() checked that with a substring test:

var isPathPermitted = filePath.indexOf(path.resolve(config.cwd())) !== -1;

Any resolved path that merely contains the cwd string passes. With cwd set to /tmp/app, a request for /%2E%2E%2Fapp-secret%2Fsecret.txt resolves to /tmp/app-secret/secret.txt and is served with a 200.

This PR checks containment with path.relative() instead, which is the check suggested in the issue. A request is rejected when the relative path is .., starts with .. plus the separator, or is absolute (another drive on Windows). These behave as before: files inside cwd (including names that start with two dots, such as ..foo.js), cwd itself, routed paths and unsafe_file_serving: true. Symlinks are still not resolved, as before.

Tests

Adds a describe block next to unsafe directory handling in tests/server_tests.js. It creates app/ and app-secret/ in a temp directory and starts the server with cwd set to app. It then checks that hello.js is served (200) and that %2E%2E%2Fapp-secret%2Fsecret.txt is rejected (403). The encoded request uses the same technique as the existing rejects a request for unsafe content test.

I could not run the mocha suite or eslint because npm dependencies could not be installed in my environment. Instead, I ran the real Server#serveStaticFile and Config on Node 22, with stand-ins for express, socket.io, compression, js-yaml and execa. A small node:http adapter passed serveStaticFile the same decoded path that the /*file route produces, and I sent the requests with Node's fetch:

I also called serveStaticFile directly. These cases are still served: ..foo.js inside cwd, cwd itself, a relative or trailing-slash cwd, / as cwd, routed paths and unsafe_file_serving: true. An absolute path elsewhere that contains the cwd string now gets 403 (it was served before). I also evaluated the new check with path.win32 for a forward-slash cwd (#1286), another drive and a drive root.

🤖 Generated with Claude Code