Jonas Zuberbuehlerandjonaszuberbuehler b3c0efd804 fix(web): keep the built-in server inside the served root (#887) ...

Root cause: the built-in web server rejected `..` segments but followed symlinks, so a committed link such as `x -> /` served any file on disk, also in Restricted Mode. The served root is canonicalized per request, and the requested file — and the index.html served for a directory — is refused with 404 when its real path lies outside it. The server opens the checked real path, and Content-Type still follows the requested name. Links inside the project (e.g. pnpm node_modules) keep working.

Fixes #886

Co-authored-by: jonaszuberbuehler <3812998+jonaszuberbuehler@users.noreply.github.com>

2026-11-02 23:39:32 +08:00

..

src

fix(web): keep the built-in server inside the served root (#887)

2026-11-02 23:39:32 +08:00

Cargo.toml

feat(web): Open HTML in browsers with a built-in server; add Emmet

2026-10-24 22:16:28 +08:00