Web UI returns 403 Forbidden on Windows due to path separator check

[yl-dev-tmtc]

Issue Type

Bug

Description

Bug

On Windows, the Web UI returns 403 Forbidden at:

http://127.0.0.1:7400/ui/

even though Codeoid starts successfully in local mode and reports:

daemon listening on 127.0.0.1:7400
web-ui (Mini App) served at /ui
web-ui: local-mode token injected — /ui needs no sign-in
frontend started: web-ui

Environment

• Windows
• Codeoid built/run from the current source checkout
• Bun 1.4.0
• Local mode (bun src/cli.ts start --local)
• Web frontend successfully built

Cause

The path traversal guard in:

src/frontends/web-ui/index.ts

uses:

if (target !== DIST && !target.startsWith(`${DIST}/`)) {

However, node:path.normalize() produces paths using \ as the separator on Windows.

For example:

DIST:
C:\Users\...\codeoid\web\dist

target:
C:\Users\...\codeoid\web\dist\index.html

Therefore target.startsWith(${DIST}/) is false even for valid files inside DIST, and the server returns 403 Forbidden.

Tested fix

Importing sep from node:path:

import { join, normalize, resolve, sep } from "node:path";

and changing the check to:

if (target !== DIST && !target.startsWith(`${DIST}${sep}`)) {

fixes the issue immediately on Windows.

After restarting Codeoid, /ui/ loads normally.

This should remain portable since sep resolves to the platform-specific path separator.

Acceptance Criteria

No response

Steps to Reproduce (for bugs)

No response

Logs / References

No response