fix: handle commas in static file paths

Author: SebF33

packages/fresh/src/middlewares/static_files.ts

@@ -3,6 +3,7 @@ import { ASSET_CACHE_BUST_KEY } from "../constants.ts";
 import { BUILD_ID } from "@fresh/build-id";
 import { tracer } from "../otel.ts";
 import { getBuildCache } from "../context.ts";
+import { systemPathToUrlEncoded } from "../dev/dev_build_cache.ts";
 
 /**
  * Fresh middleware to serve static files from the `static/` directory.
@@ -25,6 +26,12 @@ export function staticFiles<T>(): Middleware<T> {
         : "/";
     }
 
+    try {
+      pathname = systemPathToUrlEncoded(decodeURIComponent(pathname));
+    } catch {
+      return await ctx.next();
+    }
+
     // Fast path bail out
     const startTime = performance.now() + performance.timeOrigin;
     const file = await buildCache.readFile(pathname);

packages/fresh/src/middlewares/static_files_test.ts

@@ -296,3 +296,29 @@ Deno.test("static files - fallthrough", async () => {
   expect(text).toEqual("it works");
   expect(called).toEqual(["before", "after"]);
 });
+
+Deno.test("static files - comma in pathname", async () => {
+  const key = systemPathToUrlEncoded("foo,bar.css");
+
+  const buildCache = new MockBuildCache({
+    [key]: {
+      content: "body {}",
+      hash: null,
+    },
+  });
+
+  const server = serveMiddleware(
+    staticFiles(),
+    { buildCache },
+  );
+
+  // Browser/request path usually keeps the comma unencoded
+  let res = await server.get("/foo,bar.css");
+  await res.body?.cancel();
+  expect(res.status).toEqual(200);
+
+  // Encoded form should also resolve
+  res = await server.get("/foo%2Cbar.css");
+  await res.body?.cancel();
+  expect(res.status).toEqual(200);
+});