Merge commit from fork

Author: yusukebe

src/middleware/serve-static/index.test.ts

@@ -79,6 +79,15 @@ describe('Serve Static Middleware', () => {
     expect(await res.text()).toBe('404 Not Found')
   })
 
+  it('Should not allow a backslash separator injection - /static/admin%5Csecret.txt', async () => {
+    const res = await app.fetch({
+      method: 'GET',
+      url: 'http://localhost/static/admin%5Csecret.txt',
+    } as Request)
+    expect(res.status).toBe(404)
+    expect(await res.text()).toBe('404 Not Found')
+  })
+
   it('Should return a pre-compressed zstd response - /static/hello.html', async () => {
     const app = new Hono().use(
       '*',

src/middleware/serve-static/index.ts

@@ -64,7 +64,7 @@ export const serveStatic = <E extends Env = Env>(
     } else {
       try {
         filename = tryDecodeURI(c.req.path)
-        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}/.test(filename)) {
+        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}|\\/.test(filename)) {
           throw new Error()
         }
       } catch {