From e3e4fc7284fcc59716f888bee6cc64dd07089ac5 Mon Sep 17 00:00:00 2001
From: blowing-a-raspberry
 <120271497+blowing-a-raspberry@users.noreply.github.com>
Date: Sun, 18 Oct 2026 15:55:56 -0500
Subject: [PATCH] test: cover Vite fs deny hardening

---
 CHANGELOG.md                    |  1 -
 build/vite.js                   |  6 +++++-
 changelog.d/948-vite-fs-deny.md |  4 ++++
 src/tooling/viteBuild.test.mjs  | 15 ++++++++++++++-
 4 files changed, 23 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/948-vite-fs-deny.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c7445ce6..98d32365f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -445,7 +445,6 @@
   `ET-Client-Name: gods-eye-view-bikeshare` to Entur, as the operators ask,
   and accepts Entur's extensionless feed paths. Attributed under NLOD and
   Licence Ouverte. `get_bike_share` covers the six systems too.
-- Harden Vite's filesystem deny list for local-only artifacts: repo `dist/`, `.gev-logs/`, and `.gev-cache/` are denied without blocking dependency `dist/` directories, and checkout paths containing glob metacharacters are escaped before building the root-anchored pattern.
 
 - Add Norway's road cameras from Statens vegvesen as a CCTV pack. The camera
   list is one keyless GeoJSON request to the agency's OGC API view of its
diff --git a/build/vite.js b/build/vite.js
index 042b8e98d..a541eb9aa 100644
--- a/build/vite.js
+++ b/build/vite.js
@@ -18,7 +18,11 @@ const REPO_ROOT = fileURLToPath(new URL('..', import.meta.url))
   .replace(/\\/g, '/')
   .replace(/\/$/, '');
 
-const REPO_ROOT_GLOB = REPO_ROOT.replace(/[()[\]{}*?!+@|]/g, '\\$&');
+export function escapeFsDenyPath(path) {
+  return path.replace(/[()[\]{}*?!+@|]/g, '\\$&');
+}
+
+const REPO_ROOT_GLOB = escapeFsDenyPath(REPO_ROOT);
 
 /**
  * Content-Security-Policy for every document the dev/preview server serves.
diff --git a/changelog.d/948-vite-fs-deny.md b/changelog.d/948-vite-fs-deny.md
new file mode 100644
index 000000000..642bafb1f
--- /dev/null
+++ b/changelog.d/948-vite-fs-deny.md
@@ -0,0 +1,4 @@
+- Harden Vite's filesystem deny list for local-only artifacts: repo `dist/`,
+  `.gev-logs/`, and `.gev-cache/` are denied without blocking dependency
+  `dist/` directories, and checkout paths containing glob metacharacters are
+  escaped before building the root-anchored pattern (blowing-a-raspberry, #948).
diff --git a/src/tooling/viteBuild.test.mjs b/src/tooling/viteBuild.test.mjs
index 9e38a0295..9f309c48d 100644
--- a/src/tooling/viteBuild.test.mjs
+++ b/src/tooling/viteBuild.test.mjs
@@ -1,7 +1,11 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
-import { BROWSER_CSP, createBrowserViteConfig } from '../../build/vite.js';
+import {
+  BROWSER_CSP,
+  createBrowserViteConfig,
+  escapeFsDenyPath,
+} from '../../build/vite.js';
 import standaloneConfig, * as compatibility from '../../vite.config.js';
 import * as providers from '../../server/providers/local.js';
 
@@ -21,6 +25,15 @@ test('explicit build inputs preserve browser-only defines, plugin order and loop
   assert.deepEqual(config.server.allowedHosts, ['localhost', '127.0.0.1']);
   assert.ok(config.server.fs.deny.includes('**/ENVIRONMENT'));
   assert.ok(config.server.fs.deny.includes('.env.*'));
+  assert.ok(config.server.fs.deny.includes('**/.gev-logs/**'));
+  assert.ok(config.server.fs.deny.includes('**/.gev-cache/**'));
+  assert.ok(
+    config.server.fs.deny.some((pattern) => pattern.endsWith('/dist/**')),
+  );
+  assert.equal(
+    escapeFsDenyPath('C:/Users/a/gods-eye-view (1)'),
+    'C:/Users/a/gods-eye-view \\(1\\)',
+  );
   assert.equal(config.server.headers['X-Frame-Options'], 'DENY');
   assert.equal(config.server.headers['X-Content-Type-Options'], 'nosniff');
   const csp = config.server.headers['Content-Security-Policy'];