fix: isolate overlapping static mount paths

Author: webfansplz

packages/devframe/src/utils/serve-static.test.ts

@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { H3, toNodeHandler } from 'h3'
 import { afterEach, describe, expect, it } from 'vitest'
-import { serveStaticHandler, serveStaticNodeMiddleware } from './serve-static'
+import { mountStaticHandler, serveStaticHandler, serveStaticNodeMiddleware } from './serve-static'
 
 interface Fixture {
   dir: string
@@ -167,6 +167,36 @@ describe('serveStaticHandler', () => {
   })
 })
 
+describe('mountStaticHandler', () => {
+  it('keeps static bases with overlapping prefixes isolated', async () => {
+    const viteDir = makeTmp('devframe-serve-vite-')
+    const vitestDir = makeTmp('devframe-serve-vitest-')
+    writeFileSync(join(viteDir, 'index.html'), 'vite-index', 'utf-8')
+    writeFileSync(join(viteDir, 'favicon.svg'), 'vite', 'utf-8')
+    writeFileSync(join(vitestDir, 'favicon.svg'), 'vitest', 'utf-8')
+
+    const app = new H3()
+    mountStaticHandler(app, '/__devtools-vite/', viteDir)
+    mountStaticHandler(app, '/__devtools-vitest/', vitestDir)
+
+    const viteBaseResponse = await app.request('/__devtools-vite')
+    const viteBaseSlashResponse = await app.request('/__devtools-vite/')
+    const viteResponse = await app.request('/__devtools-vite/favicon.svg')
+    const vitestResponse = await app.request('/__devtools-vitest/favicon.svg')
+    const adjacentResponse = await app.request('/__devtools-vite-extra/favicon.svg')
+
+    expect(viteBaseResponse.status).toBe(200)
+    expect(await viteBaseResponse.text()).toBe('vite-index')
+    expect(viteBaseSlashResponse.status).toBe(200)
+    expect(await viteBaseSlashResponse.text()).toBe('vite-index')
+    expect(viteResponse.status).toBe(200)
+    expect(await viteResponse.text()).toBe('vite')
+    expect(vitestResponse.status).toBe(200)
+    expect(await vitestResponse.text()).toBe('vitest')
+    expect(adjacentResponse.status).toBe(404)
+  })
+})
+
 describe('serveStaticNodeMiddleware', () => {
   let fx: Fixture | undefined
 

packages/devframe/src/utils/serve-static.ts

@@ -173,8 +173,8 @@ export function serveStaticHandler(
  *
  * h3 v2's `app.use(base, handler)` only matches the exact `base` path and
  * does not strip the prefix from `event.url.pathname`. Static serving
- * needs both subpath matching (`/base/**`) and the URL stripped so the
- * file resolver sees paths relative to `dir` — this helper bundles both.
+ * needs an explicit segment-boundary match plus a stripped URL so the file
+ * resolver sees paths relative to `dir` — this helper bundles both.
  */
 export function mountStaticHandler(
   app: H3,
@@ -188,7 +188,9 @@ export function mountStaticHandler(
     app.use('/**', handler)
     return
   }
-  app.use(`${trimmed}/**`, withBase(trimmed, handler))
+  app.use(withBase(trimmed, handler), {
+    match: event => event.url.pathname === trimmed || event.url.pathname.startsWith(`${trimmed}/`),
+  })
 }
 
 /**