fix: return plaintext 404 for anything under appDir (#11597)

Co-authored-by: Rich Harris <[email protected]>
sveltejs · Jan 11, 2024 · 553e14c · 553e14c
1 parent 48576de
commit 553e14c
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/.changeset/clever-clocks-drop.md b/.changeset/clever-clocks-drop.md
@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: return plaintext 404 for anything under appDir
diff --git a/packages/kit/src/runtime/server/respond.js b/packages/kit/src/runtime/server/respond.js
@@ -113,6 +113,10 @@ export async function respond(request, options, manifest, state) {
 		return get_public_env(request);
 	}
 
+	if (decoded.startsWith(`/${options.app_dir}`)) {
+		return text('Not found', { status: 404 });
+	}
+
 	const is_data_request = has_data_suffix(decoded);
 	/** @type {boolean[] | undefined} */
 	let invalidated_data_nodes;