Skip to content

fix(cloudflare): fix baseURL traversal for wrangler assets dir#4257

Open
jel-massih wants to merge 1 commit into
nitrojs:mainfrom
jel-massih:fix/cloudflare-baseurl-traversal
Open

fix(cloudflare): fix baseURL traversal for wrangler assets dir#4257
jel-massih wants to merge 1 commit into
nitrojs:mainfrom
jel-massih:fix/cloudflare-baseurl-traversal

Conversation

@jel-massih
Copy link
Copy Markdown

@jel-massih jel-massih commented May 11, 2026

"..".repeat(N) concatenates without a separator, so for N >= 2 it produces "...." / "......" instead of "../.." / "../../..". With a 2+ segment baseURL (e.g. /foo/bar), cloudflare-module builds generate a wrangler.json whose assets.directory resolves to a non-existent .... subdirectory, breaking wrangler deploy and static asset serving.

Fix: "..".repeat(N)"../".repeat(N) so the traversal works as expected

Reproduction Steps:

Build any cloudflare-module (or cloudflare-durable) project with a baseURL of 2+ segments, e.g.:

// nitro.config.ts
export default defineNitroConfig({
  preset: "cloudflare-module",
  baseURL: "/foo/bar",
});

Then check the generated .output/server/wrangler.json: assets.directory value

Before fix:

{
  "compatibility_date": "2026-05-08",
  "main": "index.mjs",
  "assets": {
    "binding": "ASSETS",
    "directory": "../public/foo/bar/...."
  },
  ...
}

After fix:

{
  "compatibility_date": "2026-05-08",
  "main": "index.mjs",
  "assets": {
    "binding": "ASSETS",
    "directory": "../public"
  },
...
}

@jel-massih jel-massih requested a review from pi0 as a code owner May 11, 2026 02:40
@vercel
Copy link
Copy Markdown

vercel Bot commented May 11, 2026

@jel-massih is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 11, 2026

Review Change Stack

📝 Walkthrough

Walkthrough

The writeWranglerConfig function in the Cloudflare preset utilities has been reformatted. Line wrapping around the ../.repeat(...) expression for computing the overrides.assets.directory path in the module target was adjusted. No logic, values, or control flow were changed.

Changes

Wrangler Module Target Path Formatting

Layer / File(s) Summary
Assets Directory Path Formatting
src/presets/cloudflare/utils.ts
Line wrapping reformatted in the module target's overrides.assets.directory path computation around the ../.repeat(...) expression; logic and values unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title follows conventional commits format with 'fix' type prefix and includes a specific, accurate description of the fix related to baseURL traversal for Cloudflare wrangler assets directory.
Description check ✅ Passed The PR description clearly explains the bug, provides reproduction steps with before/after examples, and directly relates to the code changes made.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@jel-massih jel-massih changed the title fix(cloudflare): fix baseURL traversal for assets dir fix(cloudflare): fix baseURL traversal for wrangler assets dir May 11, 2026
@pi0
Copy link
Copy Markdown
Member

pi0 commented May 11, 2026

Thnx. Can you please provide reproductin steps?

@jel-massih
Copy link
Copy Markdown
Author

Thnx. Can you please provide reproductin steps?

Sure! Updated PR with hopefully useful repro steps.

Validated issue with basically these commands

mkdir nitro-cf-baseurl-repro && cd nitro-cf-baseurl-repro
npm init -y
npm pkg set type=module
echo 'export default { preset: "cloudflare-module", baseURL: "/foo/bar" }' > nitro.config.ts
npx nitro build
grep -A2 assets .output/server/wrangler.json

with grep output:

  "assets": {
    "binding": "ASSETS",
    "directory": "../public/foo/bar/...."

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants