Merge commit from fork

Author: yusukebe

src/serve-static.ts

@@ -111,7 +111,7 @@ export const serveStatic = <E extends Env = any>(
     } else {
       try {
         filename = tryDecodeURI(c.req.path)
-        if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
+        if (/(?:^|[\/\\])\.{1,2}(?:$|[\/\\])|[\/\\]{2,}/.test(filename)) {
           throw new Error()
         }
       } catch {

test/serve-static.test.ts

@@ -381,6 +381,9 @@ describe('Serve Static Middleware', () => {
       expect(res2.status).toBe(404)
       expect(res2.headers['x-authorized']).toBeUndefined()
       expect(res2.text).not.toBe('secret')
+
+      const res3 = await request(server).get('/static//admin/secret.txt')
+      expect(res3.status).toBe(404)
     })
   })