Restrict access to .dev.vars files

[jamesopstad]

Fixes #000.

Note: access to Worker config files has not been restricted as they can have any names. These do not contain sensitive content, however.

---

• Tests
  • TODO (before merge)
  • Tests included
  • Tests not necessary because:
• Wrangler / Vite E2E Tests CI Job required? (Use "e2e" label or ask maintainer to run separately)
  • I don't know
  • Required
  • Not required because: N/A
• Public documentation
  • TODO (before merge)
  • Cloudflare docs PR(s):
  • Documentation not necessary because: N/A
• Wrangler V3 Backport
  • TODO (before merge)
  • Wrangler PR:
  • Not necessary because: Not a Wrangler change

[changeset-bot]

🦋 Changeset detected

Latest commit: f5922b2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/vite-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@9513

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@9513

miniflare

npm i https://pkg.pr.new/miniflare@9513

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@9513

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@9513

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@9513

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@9513

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@9513

wrangler

npm i https://pkg.pr.new/wrangler@9513

commit: f5922b2

[petebacondarwin]

Once #9510 lands we should also check that env.ASSETS.fetch() also doesn't expose these files.

[petebacondarwin]

Are these the default Vite ones? Did you have to copy them over?
Is it not possible to just add our .dev.vars etc paths over the top of what Vite provides??
Doesn't Vite just merge them automatically?

[jamesopstad]

They don't get merged automatically, unfortunately. I was expecting them to be exported for this purpose (like they export defaultAllowedOrigins) but they're not. I could open a PR to Vite to export.