Function handleRequest

packages/cli/src/server.ts:136–199

(
	req: http.IncomingMessage,
	res: http.ServerResponse,
	webDist: string,
	routes: CompiledRoute[],
)

}

async function handleRequest(
	req: http.IncomingMessage,
	res: http.ServerResponse,
	webDist: string,
	routes: CompiledRoute[],
): Promise<void> {
	// Don't parse via `new URL()` — its WHATWG normalization collapses `/../foo` to `/foo`,
	// hiding traversal attempts before our guard runs. Strip the query string ourselves.
	const fullUrl = req.url ?? "/";
	const queryIdx = fullUrl.indexOf("?");
	const pathname = (queryIdx >= 0 ? fullUrl.slice(0, queryIdx) : fullUrl) || "/";
	const method = (req.method ?? "GET").toUpperCase();

	if (pathname.startsWith("/api/")) {
		for (const route of routes) {
			if (route.method !== method) continue;
			const match = route.regex.exec(pathname);
			if (!match) continue;
			const params: RouteParams = {};
			try {
				route.paramNames.forEach((name, i) => {
					params[name] = decodeURIComponent(match[i + 1] ?? "");
				});
			} catch {
				res.writeHead(400, { "Content-Type": "text/plain" });
				res.end("Bad Request");
				return;
			}
			await route.handler(req, res, params);
			return;
		}
		res.writeHead(404, { "Content-Type": "text/plain" });
		res.end("Not Found");
		return;
	}

	if (method !== "GET") {
		res.writeHead(405, { "Content-Type": "text/plain", Allow: "GET" });
		res.end("Method Not Allowed");
		return;
	}

	let decoded: string;
	try {
		decoded = decodeURIComponent(pathname);
	} catch {
		res.writeHead(400, { "Content-Type": "text/plain" });
		res.end("Bad Request");
		return;
	}

	// path.relative + a check for `..`/absolute is a CodeQL-recognized path-injection sanitizer.
	// Building filePath from the validated relative makes the data flow explicit.
	const rel = path.relative(webDist, path.resolve(webDist, `.${decoded}`));
	if (rel.startsWith("..") || path.isAbsolute(rel)) {
		res.writeHead(403, { "Content-Type": "text/plain" });
		res.end("Forbidden");
		return;