Potential fix for code scanning alert no. 25: Uncontrolled data used in path expression

[Tanker187]

Potential fix for https://github.com/Tanker187/vite/security/code-scanning/25

General approach: Ensure any filesystem path derived from req.url is both normalized and validated to be within an allowed root before use. This matches the guidance: normalize (path.resolve/realpathSync) and then assert containment using a root directory (isParentDirectory).

Best concrete fix here: the non-FS_PREFIX branch already follows this pattern. We should mirror that for the FS_PREFIX dev branch by:

1. Resolving and normalizing the decoded path against the server root.
2. Optionally using fs.realpathSync.native to collapse symlinks.
3. Verifying the final path is still inside the configured root using isParentDirectory.
4. Early-next() if the check fails, before any fs.existsSync / fsp.readFile calls.

We will only modify packages/vite/src/node/server/middlewares/indexHtml.ts inside the snippet shown, specifically the if (isDev && url.startsWith(FS_PREFIX)) { ... } block around lines 498–516. We already import normalizePath, isParentDirectory, fs, and path, so no new imports or utilities are needed.

Behavioral impact: For dev requests using FS_PREFIX, any attempt to access files outside root (via traversal or crafted FS_PREFIX paths) will now be rejected (falling through to next() / other middleware) instead of being served.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.