fix(wasm): reject .wasm outside server.fs (#23914)

packages/vite/src/node/server/middlewares/transform.ts

@@ -53,6 +53,7 @@ const urlRE = /[?&]url\b/
 const rawRE = /[?&]raw\b/
 const inlineRE = /[?&]inline\b/
 const svgRE = /\.svg\b/
+const wasmRE = /(?<![?#].*)\.wasm$/
 const wasmInstanceRE = /[?&]vite-wasm-instance(?:&|$)/
 
 export function isServerAccessDeniedForTransform(
@@ -64,6 +65,7 @@ export function isServerAccessDeniedForTransform(
     urlRE.test(id) ||
     inlineRE.test(id) ||
     svgRE.test(id) ||
+    wasmRE.test(id) ||
     wasmInstanceRE.test(id)
   ) {
     return (

playground/fs-serve/__tests__/commonTests.ts

@@ -127,6 +127,13 @@ export function tests() {
         disableVariants: [''],
       },
 
+      {
+        name: 'unsafe WASM import',
+        testId: 'unsafe-wasm-import',
+        content: /403 Restricted/,
+        status: '403',
+      },
+
       {
         name: 'unsafe fetch',
         testId: 'unsafe',

playground/fs-serve/root/matrixTestResultPlugin.ts

@@ -9,6 +9,7 @@ const testIds = [
   'safe-subdir-special-characters2',
   'safe-imported',
   'safe-imported-query',
+  'unsafe-wasm-import',
   'unsafe',
   'unsafe-json',
   'unsafe-html',

playground/fs-serve/root/src/index.html

@@ -83,6 +83,11 @@
     // imported before with query
     { testId: 'safe-imported-query', path: '/safe.json?query' },
 
+    {
+      testId: 'unsafe-wasm-import',
+      path: '/root/unsafe.wasm?import',
+    },
+
     // outside of allowed dir
     { testId: 'unsafe', path: '/root/unsafe.txt' },
     // outside of allowed dir and root

playground/fs-serve/root/unsafe.wasm

@@ -0,0 +1 @@
+KEY=unsafe