Allow URLs containing absolute filepaths in imports if they match specific file extensions

This is to support ../../ imports

Allowlisting to specific file extensions prevents common webserver security vulnerabilities like reading /etc/passwd

1 files changed, 8 insertions, 1 deletions

diff --git a/src/options.zig b/src/options.zig
index 937e6a5aa..83901403c 100644
--- a/src/options.zig
+++ b/src/options.zig
@@ -1104,7 +1104,14 @@ pub const BundleOptions = struct {
                             opts.node_modules_bundle = node_module_bundle;
 
                             if (opts.origin.isAbsolute()) {
-                                opts.node_modules_bundle_url = try opts.origin.joinAlloc(allocator, "", "", node_module_bundle.bundle.import_from_name, "");
+                                opts.node_modules_bundle_url = try opts.origin.joinAlloc(
+                                    allocator,
+                                    "",
+                                    "",
+                                    node_module_bundle.bundle.import_from_name,
+                                    "",
+                                    "",
+                                );
                                 opts.node_modules_bundle_pretty_path = opts.node_modules_bundle_url[opts.node_modules_bundle_url.len - node_module_bundle.bundle.import_from_name.len - 1 ..];
                             } else {
                                 opts.node_modules_bundle_pretty_path = try allocator.dupe(u8, pretty_path);