Skip to content

fix: isolate overlapping static mount paths#102

Open
webfansplz wants to merge 2 commits into
devframes:mainfrom
webfansplz:fix/static-route-boundary
Open

fix: isolate overlapping static mount paths#102
webfansplz wants to merge 2 commits into
devframes:mainfrom
webfansplz:fix/static-route-boundary

Conversation

@webfansplz

Copy link
Copy Markdown
Contributor

Fix static route collisions when one mount path is a prefix of another, such as:

  • /__devtools-vite/
  • /__devtools-vitest/

H3's wildcard middleware matcher allowed the shorter path to intercept requests for the longer path. Static mounts now use an explicit segment-boundary matcher, ensuring each request reaches the correct directory regardless of registration order.

Added regression coverage for:

  • Overlapping static route prefixes
  • Base paths with and without trailing slashes
  • Adjacent paths that should return 404

Case:

iShot_2026-07-16_12 47 37

Copilot AI review requested due to automatic review settings July 16, 2026 06:11
@netlify

netlify Bot commented Jul 16, 2026

Copy link
Copy Markdown

Deploy Preview for devfra ready!

Name Link
🔨 Latest commit 1ed6573
🔍 Latest deploy log https://app.netlify.com/projects/devfra/deploys/6a587611e06bde0008c5702e
😎 Deploy Preview https://deploy-preview-102--devfra.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a static routing edge case in devframe’s h3 integration where overlapping mount path prefixes (e.g. /__devtools-vite/ vs /__devtools-vitest/) could collide due to wildcard prefix matching, causing the wrong static directory to serve requests. The update switches static mounting to h3 sub-app mounting, which provides segment-boundary matching and base-path stripping.

Changes:

  • Reworked mountStaticHandler to mount a dedicated h3 sub-app per static base, avoiding prefix route collisions.
  • Simplified/updated the helper’s documentation to reflect the new mounting behavior.
  • Added regression tests covering root mounting, overlapping prefixes, trailing-slash behavior, and adjacent non-matching paths returning 404.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
packages/devframe/src/utils/serve-static.ts Switches static mounting to an h3 sub-app via app.mount() to ensure segment-boundary matching and correct base stripping.
packages/devframe/src/utils/serve-static.test.ts Adds tests that reproduce/guard against overlapping-prefix collisions and validates expected 200/404 behavior across base path variants.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants