From ed26a8243d64b6e822d2972be094d71699e4bf0d Mon Sep 17 00:00:00 2001
From: tiago <70700766+tiagozip@users.noreply.github.com>
Date: Sat, 18 Apr 2026 18:29:38 +0100
Subject: [PATCH] fix: resolve wildcard path against assetsDir before read

---
 src/index.ts | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/index.ts b/src/index.ts
index 12aaf86..73c0544 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -299,14 +299,15 @@ export async function staticPlugin<const Prefix extends string = '/prefix'>({
         app.onError(() => {}).get(
             `${prefix.endsWith('/') ? prefix.slice(0, -1) : prefix}/*`,
             async ({ params, headers: requestHeaders }) => {
-                const pathName = normalizePath(
-                    path.join(
-                        assets,
-                        decodeURI
-                            ? (fastDecodeURI(params['*']) ?? params['*'])
-                            : params['*']
-                    )
-                )
+                const userPart = decodeURI
+                    ? (fastDecodeURI(params['*']) ?? params['*'])
+                    : params['*']
+
+                const joined = path.resolve(assetsDir, userPart)
+                if (joined !== assetsDir && !joined.startsWith(assetsDir + path.sep))
+                    throw new NotFoundError()
+
+                const pathName = normalizePath(joined)
 
                 if (shouldIgnore(pathName)) throw new NotFoundError()