[web] Don't serve files outside of project by mdebbar · Pull Request #180699 · flutter/flutter

mdebbar · 2026-01-08T18:31:41Z

Fixes internal bug: b/463611148

gemini-code-assist

Code Review

This pull request enhances security by restricting the file search paths in ReleaseAssetServer. The changes remove search paths pointing to the user's home directory and the parent of the Flutter root, mitigating a path traversal vulnerability that could allow serving files from outside the project. A new test is added to confirm that requests for files outside the intended directories now correctly fall back to serving index.html, preventing unauthorized file access. The changes appear correct and effectively address the security concern.

harryterkelsen · 2026-01-08T18:38:51Z

+        final Response response = await server.handle(
+          Request('GET', Uri.parse('http://foobar/$path')),
+        );
+        expect(response.statusCode, 200, reason: 'Path "$path" should return 200 and index.html');


So the expected behavior is for any URL that doesn't point to an existing file under the project directory to return index.html? Is it possible to 404?

We can and in fact, that's what we used to do in the past. But then PathUrlStrategy doesn't work.

If the app defines routes such as /settings, /users/123, etc, you want to be able to hit refresh at any of those paths and be served with the index.html file.

With the HashUrlStrategy, the url in the address bar becomes http://localhost:xxxx/#/users/123. Hitting refresh will request / from the server, which correctly serves index.html.

But with PathUrlStrategy, the url in the address bar becomes http://localhost:xxxx/users/123. Hitting refresh will request /users/123 from the server, which returns 404 since there's no file called users/123 in the file system.

Ah, that makes sense. Thanks

harryterkelsen

LGTM

…80699)

Roll Flutter from 01d37bc to 73769a2 (65 revisions) flutter/flutter@01d37bc...73769a2 2026-01-10 [email protected] Roll Dart SDK from 5e855c2bb3ef to 87fbfd5381b6 (1 revision) (flutter/flutter#180800) 2026-01-10 [email protected] Roll Skia from b2b109f0e980 to f39cc645b1dd (2 revisions) (flutter/flutter#180796) 2026-01-10 [email protected] Roll Dart SDK from b7963905e6a2 to 5e855c2bb3ef (2 revisions) (flutter/flutter#180794) 2026-01-10 [email protected] Make sure that a CupertinoTabScaffold doesn't crash in 0x0 environment (flutter/flutter#179824) 2026-01-10 [email protected] Roll Dart SDK from d25ad331b7ea to b7963905e6a2 (2 revisions) (flutter/flutter#180783) 2026-01-10 [email protected] Make sure that a Container doesn't crash in 0x0 environment (flutter/flutter#180350) 2026-01-10 [email protected] Make sure that an Expansible doesn't crash in 0x0 environment (flutter/flutter#180478) 2026-01-10 98614782+auto-submit[bot]@users.noreply.github.com Reverts "Enabled some disabled impeller fragment shader dart tests (#180759)" (flutter/flutter#180785) 2026-01-09 [email protected] Merge `widget_tester_leaks_free_test.dart` into `widget_tester_test.dart` (flutter/flutter#180600) 2026-01-09 [email protected] fix: there are no riscv fuchsia artifacts (flutter/flutter#180779) 2026-01-09 [email protected] Roll Skia from 7386219151e6 to b2b109f0e980 (1 revision) (flutter/flutter#180771) 2026-01-09 [email protected] Re-prioritize pipeline compile jobs and perform them eagerly instead of waiting. (flutter/flutter#180022) 2026-01-09 [email protected] Enabled some disabled impeller fragment shader dart tests (flutter/flutter#180759) 2026-01-09 [email protected] Roll Fuchsia Linux SDK from rxeg-6UB678HKJ4UQ... to 83Favz_zzMzdVuOHg... (flutter/flutter#180765) 2026-01-09 [email protected] [A11y ] Add `clearSemantics`in table (flutter/flutter#180665) 2026-01-09 [email protected] Update CODEOWNERS to remove chinmaygarde. (flutter/flutter#180703) 2026-01-09 [email protected] [ Tool ] Add support for linux riscv64 architecture (flutter/flutter#178711) 2026-01-09 [email protected] Roll Skia from e9b3264ade0c to 7386219151e6 (12 revisions) (flutter/flutter#180754) 2026-01-09 [email protected] Roll Dart SDK from fe2ba2c5dd50 to d25ad331b7ea (10 revisions) (flutter/flutter#180741) 2026-01-09 98614782+auto-submit[bot]@users.noreply.github.com Reverts "Unpin google_mobile_ads (#180573)" (flutter/flutter#180761) 2026-01-09 [email protected] Fix typo in dropdown_menu.dart (flutter/flutter#180172) 2026-01-09 [email protected] Roll Packages from 039a026 to 51fe1d9 (1 revision) (flutter/flutter#180742) 2026-01-09 [email protected] Unpin google_mobile_ads (flutter/flutter#180573) 2026-01-09 [email protected] Update flutter changelog for 3.38.6 (flutter/flutter#180708) 2026-01-08 98614782+auto-submit[bot]@users.noreply.github.com Reverts "Fix iOS xattr removal to clear all extended attributes (#180355)" (flutter/flutter#180709) 2026-01-08 [email protected] Make sure that an EditableText doesn't crash in 0x0 environment (flutter/flutter#180457) 2026-01-08 [email protected] Implementation of tooltip windows for win32 (flutter/flutter#179147) 2026-01-08 [email protected] [web] Don't serve files outside of project (flutter/flutter#180699) 2026-01-08 [email protected] Roll Skia from 837be28dd218 to e9b3264ade0c (1 revision) (flutter/flutter#180702) 2026-01-08 [email protected] Add new motion accessibility features to iOS. (flutter/flutter#178102) 2026-01-08 [email protected] Fix iOS xattr removal to clear all extended attributes (flutter/flutter#180355) 2026-01-08 [email protected] [ Widget Preview ] Move widget_preview_scaffold tests to `dev/integration_tests/widget_preview_scaffold` (flutter/flutter#180658) 2026-01-08 [email protected] De-interleaves engine dart test output (flutter/flutter#180651) 2026-01-08 [email protected] [web] Fix SemanticsService.announce not working inside dialogs (flutter/flutter#179958) 2026-01-08 [email protected] Roll Skia from 42233226ac56 to 837be28dd218 (2 revisions) (flutter/flutter#180693) 2026-01-08 [email protected] Roll Dart SDK to 3.11.0-296.2.beta (flutter/flutter#180685) 2026-01-08 [email protected] Improve code quality in `AndroidTouchProcessorTest.java` (flutter/flutter#180583) 2026-01-08 [email protected] Revert "Reverts "[reland] Unify canvas creation and Surface code in S…kwasm and CanvasKit (#179473)" (#180152)" (flutter/flutter#180610) 2026-01-08 [email protected] Roll Skia from a0c407bce408 to 42233226ac56 (4 revisions) (flutter/flutter#180688) 2026-01-08 [email protected] [ Tool ] Fix flake in overall_experience_test.dart (flutter/flutter#180655) 2026-01-08 [email protected] Roll Packages from 9705815 to 039a026 (6 revisions) (flutter/flutter#180684) 2026-01-08 [email protected] flutter_tools: Auto-generate ExportOptions.plist for manual iOS code signing (flutter/flutter#177888) 2026-01-08 [email protected] Roll Skia from 58837e160874 to a0c407bce408 (2 revisions) (flutter/flutter#180679) 2026-01-08 [email protected] Roll Skia from 1e3266fdba86 to 58837e160874 (1 revision) (flutter/flutter#180677) 2026-01-08 [email protected] Roll Skia from 3c47ea10638f to 1e3266fdba86 (4 revisions) (flutter/flutter#180675) 2026-01-08 [email protected] Roll Fuchsia Linux SDK from dTvN_JVSCfGFRasvH... to rxeg-6UB678HKJ4UQ... (flutter/flutter#180673) ...

… and source files (flutter#187437) ## Summary The release web asset server (`ReleaseAssetServer`, used for release/profile/wasm web builds served via `flutter run -d web-server`/`chrome`) searches three roots when resolving each request: ```dart List<Uri> _searchPaths() => <Uri>[ _fileSystem.directory(_webBuildDirectory).uri, _fileSystem.directory(_flutterRoot).uri, _fileSystem.currentDirectory.uri, ]; ``` and returns every matched file with `Access-Control-Allow-Origin: *`. The project root (`currentDirectory`) and the Flutter SDK root (`_flutterRoot`) are only needed so that the original Dart sources and `.map` files referenced by a build's **source maps** can be resolved. Because the whole roots were searched for any request, unrelated files under them — for example `.env`, `android/key.properties`, or other project/SDK files — were served as well, in addition to the intended web build output. This is a follow-up to flutter#180699 ("[web] Don't serve files outside of project"), which removed the home directory and the SDK parent directory from the search paths but intentionally kept the project root and SDK root for source-map resolution. This change tightens those two remaining roots. ## Change Restrict the project root and Flutter SDK root to the file extensions that source-map resolution actually needs (`.dart` and `.map`). The web build output directory stays unrestricted because it only contains generated, publishable assets. Result: - Web build output (`build/web`) — served as before (any file type). - Source files referenced by source maps (`lib/main.dart`, SDK `.dart`, `.map`) — still served from the project and SDK roots. - Unrelated files under the project/SDK roots (`.env`, signing config, etc.) — no longer served; they fall through to the `index.html` fallback. ## Test Adds a test to `web_asset_server_test.dart` asserting that source files are still served from the project and SDK roots, while non-source files under them are not. `dart analyze` is clean for both changed files.

[web] Don't serve files outside of project

639f32b

github-actions Bot added the tool Affects the "flutter" command-line tool. See also t: labels. label Jan 8, 2026

gemini-code-assist Bot reviewed Jan 8, 2026

View reviewed changes

harryterkelsen reviewed Jan 8, 2026

View reviewed changes

harryterkelsen approved these changes Jan 8, 2026

View reviewed changes

maybe fix windows failure

891768a

mdebbar added the autosubmit Merge PR when tree becomes green via auto submit App label Jan 8, 2026

auto-submit Bot added this pull request to the merge queue Jan 8, 2026

Merged via the queue into flutter:master with commit 40d28b0 Jan 8, 2026
141 checks passed

flutter-dashboard Bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Jan 8, 2026

engine-flutter-autoroll mentioned this pull request Jan 9, 2026

Roll Flutter from 01d37bc80fd5 to 96403e0fa570 (41 revisions) flutter/packages#10756

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 9, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

7eeca09

…80699)

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 9, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

8d3feea

…80699)

This was referenced Jan 9, 2026

Roll Flutter from 01d37bc80fd5 to c1e1dc260fb7 (43 revisions) flutter/packages#10757

Closed

Roll Flutter from 01d37bc80fd5 to fd1fad23f595 (44 revisions) flutter/packages#10759

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 9, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

66614d7

…80699)

engine-flutter-autoroll mentioned this pull request Jan 9, 2026

Roll Flutter from 01d37bc80fd5 to 61b241292e19 (45 revisions) flutter/packages#10760

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 9, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

4a8287e

…80699)

engine-flutter-autoroll mentioned this pull request Jan 10, 2026

Roll Flutter from 01d37bc80fd5 to 0b7596b3f269 (64 revisions) flutter/packages#10768

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 10, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

bc08a52

…80699)

engine-flutter-autoroll mentioned this pull request Jan 10, 2026

Roll Flutter from 01d37bc80fd5 to 73769a220639 (65 revisions) flutter/packages#10769

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 10, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

164bb60

…80699)

engine-flutter-autoroll mentioned this pull request Jan 10, 2026

Roll Flutter from 01d37bc80fd5 to 73769a220639 (65 revisions) flutter/packages#10770

Merged

engine-flutter-autoroll added a commit to engine-flutter-autoroll/packages that referenced this pull request Jan 10, 2026

40d28b0 [web] Don't serve files outside of project (flutter/flutter#1…

c661570

…80699)

mdebbar deleted the serving_outside_files branch January 27, 2026 16:49

adilburaksen mentioned this pull request Jun 2, 2026

[flutter_tools] Restrict release web asset server to the build output and source files #187437

Merged

Navigation Menu

Repository navigation

[web] Don't serve files outside of project - #180699

[web] Don't serve files outside of project#180699
auto-submit[bot] merged 2 commits into
flutter:masterfrom
mdebbar:serving_outside_files

mdebbar commented Jan 8, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

harryterkelsen Jan 8, 2026

Uh oh!

mdebbar Jan 8, 2026 •

edited

Loading

Uh oh!

harryterkelsen Jan 8, 2026

Uh oh!

harryterkelsen left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mdebbar commented Jan 8, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

harryterkelsen Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

mdebbar Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

harryterkelsen Jan 8, 2026

Choose a reason for hiding this comment

Uh oh!

harryterkelsen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mdebbar Jan 8, 2026 •

edited

Loading