Run & review this pull request in StackBlitz Codeflow.

I don't think we should allow every path from node_modules. The current function will also allow users to access any node_modules folder in your system. We should check what is different in PnP here that makes the current checks fail. As a workaround, you can probably add the folder where this font is to server.fs.allow.

Yeah I agree with patak here. Maybe we can check if we're running in yarn pnp and allowlist the yarn directory to be served? I'm not sure if yarn exposes that via process.env.* or pnpapi.

Hi @bluwy I have checked pnpapi and process.env.* however it seems it does not expose to us where the yarn cache directory is.

Hi @patak-dev Even though the pnpapi does not give us the yarn cache directory, we can get it from the @yarnpkg/core API. Would you mind take another review? Thanks!

@yarnpkg/core has 10.7MB so I don't think we should put it in the dependencies. I think we can call yarn config get <key> as it is supported by yarn v1,v2,v3,v4. Executing a command is a bit slow, but we apply many deopts for pnp so I think it's fine.

The large @yarnpkg/core dependency is removed.

Shall we consider add a searchForYarnCacheFolder function similar to searchForWorkspaceRoot to the index.ts and expose that to the user?

I'm thinking we could always add the yarn cache folder to the allow list by default, that way we don't have to expose a new API for it. Similarly we have the resolvedClientDir handling that we always allow. Curious to hear what others think too 🤔

I agree with @bluwy. If users want to disable it, deny can be used as it has higher priority (they'd need to get the path by themselves though).

Sounds good, the yarnCacheDir is now always added to the allow list.