@@ -78,9 +78,9 @@ const MAX_WEBAPPLICATION_JSON_BYTES = 102_400; // 100 KB
7878// Matches ".." as a standalone path segment.
7979const DOT_DOT_SEGMENT = / (?: ^ | [ / \\ ] ) \. \. [ / \\ ] | (?: ^ | [ / \\ ] ) \. \. $ / ;
8080
81- /** Strip leading separators so "/index.html" resolves relative to outputDir. */
81+ /** Strip leading forward slashes so "/index.html" resolves relative to outputDir. Only strips '/', not backslashes . */
8282function stripLeadingSep ( p : string ) : string {
83- return p . replace ( new RegExp ( `^[ ${ sep . replace ( / \\ / g , '\\\\' ) } /]+` ) , '' ) ;
83+ return p . replace ( / ^ \/ + / , '' ) ;
8484}
8585
8686/** Returns a reason string if the path contains unsafe patterns, undefined otherwise. */
@@ -233,13 +233,14 @@ function validateOutputDir(value: unknown): string {
233233 'Set outputDir to a directory path like "dist" or "build".' ,
234234 ] ) ;
235235 }
236- if ( value . length === 0 ) {
236+ const stripped = stripLeadingSep ( value ) ;
237+ if ( stripped . length === 0 ) {
237238 throw createConfigError ( msgs . getMessage ( 'webapp_empty_value' , [ 'outputDir' ] ) , [
238239 'Provide a directory name, e.g. "dist".' ,
239240 ] ) ;
240241 }
241- assertSafePath ( value , 'outputDir' ) ;
242- return value ;
242+ assertSafePath ( stripped , 'outputDir' ) ;
243+ return stripped ;
243244}
244245
245246function validateRouting ( value : unknown ) : void {
0 commit comments