From 28c4bacd2a03f46085d2246daf0c5d219f4a9a55 Mon Sep 17 00:00:00 2001 From: Doxa Maps Date: Tue, 29 Sep 2026 05:07:45 +0000 Subject: [PATCH] Public Studio: the checkout's .git is not served (fs.deny), with Vite's defaults kept The resolved config in ACCESS=public (Vite 5.4.21) had strict file serving with /app/repo as the only allowed root, and a deny list of Vite's defaults (.env, .env.*, certificates). The .git folder sat inside the allowed root and was not denied, so a public Studio could serve the repository's git internals. In public mode the deny list adds **/.git/**; the defaults are restated because setting deny replaces them. --- deployment/cloud/vite.cloud.config.mjs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deployment/cloud/vite.cloud.config.mjs b/deployment/cloud/vite.cloud.config.mjs index 34138a879..3a304120a 100644 --- a/deployment/cloud/vite.cloud.config.mjs +++ b/deployment/cloud/vite.cloud.config.mjs @@ -81,6 +81,9 @@ export default async (e) => { allowedHosts: true, ...(hmr ? { hmr } : {}), ...(PUBLIC ? { proxy: { '^/(cdn|api-prod|pb|admin)/': { target: 'http://127.0.0.1:5175', ws: true } } } : {}), + // Public: the checkout's git internals are not served either (the private history, .git/config). Vite's + // defaults are restated because setting deny replaces them. + ...(PUBLIC ? { fs: { strict: true, deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**'] } } : {}), }, }) }