fix(serve-static): normalize all backslashes in file paths, not just the first (#4962)

francisjohnjohnston-web · Prodia Evolution Worker · web-flow · commit 82dad6297c90 · 2026-05-24T17:42:00.000+09:00
`getFilePathWithoutDefaultDocument` converts backslash separators to slashes so
the same path resolves consistently regardless of the separator style of the
incoming request. The replace used a non-global regex (`/\/`), so only the
FIRST backslash was converted: a path with multiple segments like
`foo\bar\baz.txt` became `foo/bar\baz.txt` — mixed separators that resolve to the
wrong file (or 404) on platforms that don't treat `\` as a separator. The
adjacent comment (`foo\bar.txt =&gt; foo/bar.txt`) shows the intent was to
normalize all of them.

Fix: add the `g` flag (`/\/g`). Behaviour is unchanged for any path with zero
or one backslash, so all existing tests pass; added a regression test covering a
multi-segment path (with and without `root`) that returns the broken
`foo/bar\baz.txt` before this change.

tsc --noEmit clean; eslint + prettier clean.

Co-authored-by: Prodia Evolution Worker &lt;evo@prodia.dev&gt;
diff --git a/src/utils/filepath.test.ts b/src/utils/filepath.test.ts
@@ -43,6 +43,17 @@ describe('getFilePathWithoutDefaultDocument', () => {
     expect(
       getFilePathWithoutDefaultDocument({ filename: slashToBackslash('./..foo../bar.txt') })
     ).toBe('..foo../bar.txt')
+
+    // Multiple path segments: every backslash must be normalized, not just the first
+    expect(
+      getFilePathWithoutDefaultDocument({ filename: slashToBackslash('foo/bar/baz.txt') })
+    ).toBe('foo/bar/baz.txt')
+    expect(
+      getFilePathWithoutDefaultDocument({
+        filename: slashToBackslash('foo/bar/baz.txt'),
+        root: 'assets',
+      })
+    ).toBe('assets/foo/bar/baz.txt')
   })
 })
 
diff --git a/src/utils/filepath.ts b/src/utils/filepath.ts
@@ -43,7 +43,7 @@ export const getFilePathWithoutDefaultDocument = (
   filename = filename.replace(/^\.?[\/\\]/, '')
 
   // foo\bar.txt => foo/bar.txt
-  filename = filename.replace(/\\/, '/')
+  filename = filename.replace(/\\/g, '/')
 
   // assets/ => assets
   root = root.replace(/\/$/, '')
