[sapper] Path Traversal

I would like to report a critical path traversal vunerability in the sapper module It allows an attacker to simply obain arbitrary files from the remote server, exploiting a simple path traversal using URL-encoded "../".

function serve({ prefix, pathname, cache_control }



) {
  const filter = pathname
    ? (req) => req.path === pathname
    : (req) => req.path.startsWith(prefix);

  const cache = new Map();

  const read = dev
    ? (file) => fs.readFileSync(path.resolve(build_dir, file))
    : (file) => …