[bun.js] Fix bug with getPublicPath when encountering URLs above the root

1 files changed, 17 insertions, 8 deletions

diff --git a/src/javascript/jsc/javascript.zig b/src/javascript/jsc/javascript.zig
index 0e0646fb6..0fa8d76ba 100644
--- a/src/javascript/jsc/javascript.zig
+++ b/src/javascript/jsc/javascript.zig
@@ -610,14 +610,23 @@ pub const Bun = struct {
     pub fn getPublicPath(to: string, origin: URL, comptime Writer: type, writer: Writer) void {
         const relative_path = VirtualMachine.vm.bundler.fs.relativeTo(to);
         if (origin.isAbsolute()) {
-            origin.joinWrite(
-                Writer,
-                writer,
-                VirtualMachine.vm.bundler.options.routes.asset_prefix_path,
-                "",
-                relative_path,
-                "",
-            ) catch unreachable;
+            if (strings.hasPrefix(relative_path, "..") or strings.hasPrefix(relative_path, "./")) {
+                writer.writeAll(origin.origin) catch return;
+                writer.writeAll("/abs:") catch return;
+                if (std.fs.path.isAbsolute(to)) {
+                    writer.writeAll(to) catch return;
+                } else {
+                    writer.writeAll(VirtualMachine.vm.bundler.fs.abs(&[_]string{to})) catch return;
+                }
+            } else {
+                origin.joinWrite(
+                    Writer,
+                    writer,
+                    VirtualMachine.vm.bundler.options.routes.asset_prefix_path,
+                    "",
+                    relative_path,
+                    "",
+                ) catch return;
         } else {
             writer.writeAll(std.mem.trimLeft(u8, relative_path, "/")) catch unreachable;
         }