fix(webui): fix path regexp cve, close cordiverse/cordis#15

cordiverse · Sep 17, 2024 · 24dd1e6 · 24dd1e6
1 parent 695885c
commit 24dd1e6
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/plugins/webui/package.json b/plugins/webui/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@cordisjs/plugin-webui",
   "description": "Web User Interface for Koishi",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "type": "module",
   "exports": {
     ".": {

diff --git a/plugins/webui/src/index.ts b/plugins/webui/src/index.ts
@@ -130,7 +130,7 @@ class NodeWebUI extends WebUI<NodeWebUI.Config> {
   private serveAssets() {
     const { uiPath } = this.config
 
-    this.ctx.server.get(uiPath + '(/.+)*', async (ctx, next) => {
+    this.ctx.server.get(uiPath + '(.*)', async (ctx, next) => {
       await next()
       if (ctx.body || ctx.response.body) return
 
@@ -244,7 +244,7 @@ class NodeWebUI extends WebUI<NodeWebUI.Config> {
       }],
     })
 
-    this.ctx.server.all('/vite(/.+)*', (ctx) => new Promise((resolve) => {
+    this.ctx.server.all('/vite(.*)', (ctx) => new Promise((resolve) => {
       this.vite.middlewares(ctx.req, ctx.res, resolve)
     }))