26d45cf2cb
A request for path `//` (also `///`, `/\`, ...) makes `new URL(req.url, base)` throw ERR_INVALID_URL. serveStatic runs synchronously inside the createServer callback, so the throw is an uncaught exception that kills the process. Docker (`unless-stopped`) restarts it, and a client looping on `//` crash-loops the journal — a trivial unauthenticated DoS. This fired the "Container restart loop" Grafana alert in production (journal restarted ~10x in 6 minutes). Guard the URL parse with try/catch and fall through to the React Router handler, which 404s malformed paths cleanly (the same way it already handles scanner probes like /root/.ssh/id_rsa). Extract serveStatic into its own module so it can be unit-tested without booting the HTTP server, and add a regression test covering the malformed-path cases. Widen the journal vitest include to discover co-located tests for root-level server infra. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
18 lines
578 B
TypeScript
18 lines
578 B
TypeScript
import { defineConfig, mergeConfig } from "vitest/config";
|
|
import shared from "../../vitest.shared.ts";
|
|
import { resolve } from "node:path";
|
|
|
|
export default mergeConfig(shared, defineConfig({
|
|
test: {
|
|
// mergeConfig concatenates arrays, so this adds to the shared
|
|
// include globs rather than replacing them. Picks up co-located
|
|
// tests for root-level server infra (server.ts, serve-static.ts)
|
|
// that live outside app/ and src/.
|
|
include: ["*.test.{ts,tsx}"],
|
|
},
|
|
resolve: {
|
|
alias: {
|
|
"~": resolve(import.meta.dirname, "app"),
|
|
},
|
|
},
|
|
}));
|