Merge commit from fork

* test: cover path traversal when publicPath has no trailing slash

Ref: GHSA-g84c-rxfj-3j2c

* fix: reject requests that resolve outside the output directory

Ref: GHSA-g84c-rxfj-3j2c

Author: UlisesGascon

src/utils/getFilenameFromUrl.js

@@ -115,6 +115,24 @@ function getFilenameFromUrl(context, url, extra = {}) {
         pathname.slice(publicPathPathname.length),
       );
 
+      // The resolved filename must stay within `outputPath`. When `publicPath`
+      // has no trailing slash a sibling path can share its prefix (for example
+      // `/assets../secret` starts with `/assets`), so the stripped remainder may
+      // contain `..` that escapes the output root once joined. The `..` guard
+      // above runs on the un-stripped pathname and does not catch this, so
+      // verify containment on the final path.
+      const relative = path.relative(outputPath, filename);
+
+      if (
+        relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)
+      ) {
+        extra.errorCode = 403;
+
+        return;
+      }
+
       try {
         extra.stats = context.outputFileSystem.statSync(filename);
       } catch {

test/middleware.test.js

@@ -833,6 +833,62 @@ describe.each([
     });
 
     describe("basic", () => {
+      // @see https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-g84c-rxfj-3j2c
+      describe("should not allow path traversal when publicPath has no trailing slash", () => {
+        let compiler;
+
+        const outputPath = path.resolve(
+          __dirname,
+          "./outputs/traversal-no-slash-public-path",
+        );
+
+        beforeAll(async () => {
+          compiler = getCompiler({
+            ...webpackConfig,
+            output: {
+              filename: "bundle.js",
+              path: outputPath,
+              publicPath: "/static",
+            },
+          });
+
+          [server, req, instance] = await frameworkFactory(
+            name,
+            framework,
+            compiler,
+          );
+
+          instance.context.outputFileSystem.mkdirSync(outputPath, {
+            recursive: true,
+          });
+          instance.context.outputFileSystem.writeFileSync(
+            path.resolve(outputPath, "index.html"),
+            "HTML",
+          );
+          // A sensitive file placed one level above the served output root.
+          instance.context.outputFileSystem.writeFileSync(
+            path.resolve(outputPath, "../secret.txt"),
+            "TOP SECRET",
+          );
+        });
+
+        afterAll(async () => {
+          await close(server, instance);
+        });
+
+        it('should serve a legitimate file under the "/static" prefix', async () => {
+          const response = await req.get("/static/index.html");
+
+          expect(response.statusCode).toBe(200);
+        });
+
+        it("should not allow to get files above root", async () => {
+          const response = await req.get("/static../secret.txt");
+
+          expect(response.statusCode).toBe(403);
+        });
+      });
+
       describe("should work", () => {
         let compiler;
         let codeContent;