Allow Workers Assets to be configured on a path (#7476)

.changeset/early-baboons-fly.md

@@ -0,0 +1,7 @@
+---
+"wrangler": minor
+---
+
+feat: allow routing to Workers with Assets on any HTTP route, not just the root. For example, `example.com/blog/*` can now be used to serve assets.
+These assets will be served as though the assets directly were mounted to the root.
+For example, if you have `assets = { directory = "./public/" }`, a route like `"example.com/blog/*"` and a file `./public/blog/logo.png`, this will be available at `example.com/blog/logo.png`. Assets outside of directories which match the configured HTTP routes can still be accessed with the [Assets binding](https://developers.cloudflare.com/workers/static-assets/binding/#binding) or with a [Service binding](https://developers.cloudflare.com/workers/runtime-apis/bindings/service-bindings/) to this Worker.

packages/workers-shared/asset-worker/tests/handler.test.ts

@@ -1,4 +1,5 @@
 import { vi } from "vitest";
+import { applyConfigurationDefaults } from "../src/configuration";
 import { handleRequest } from "../src/handler";
 import type { AssetConfig } from "../../utils/types";
 
@@ -100,4 +101,53 @@ describe("[Asset Worker] `handleRequest`", () => {
 
 		expect(response.status).toBe(200);
 	});
+
+	it("cannot fetch assets outside of configured path", async () => {
+		const assets: Record<string, string> = {
+			"/blog/test.html": "aaaaaaaaaa",
+			"/blog/index.html": "bbbbbbbbbb",
+			"/index.html": "cccccccccc",
+			"/test.html": "dddddddddd",
+		};
+
+		// Attempt to path traverse down to the root /test within asset-server
+		let response = await handleRequest(
+			new Request("https://example.com/blog/../test"),
+			applyConfigurationDefaults({}),
+			async (pathname: string) => {
+				if (pathname.startsWith("/blog/")) {
+					// our route
+					return assets[pathname] ?? null;
+				} else {
+					return null;
+				}
+			},
+			async (_: string) => ({
+				readableStream: new ReadableStream(),
+				contentType: "text/html",
+			})
+		);
+
+		expect(response.status).toBe(404);
+
+		// Attempt to path traverse down to the root /test within asset-server
+		response = await handleRequest(
+			new Request("https://example.com/blog/%2E%2E/test"),
+			applyConfigurationDefaults({}),
+			async (pathname: string) => {
+				if (pathname.startsWith("/blog/")) {
+					// our route
+					return assets[pathname] ?? null;
+				} else {
+					return null;
+				}
+			},
+			async (_: string) => ({
+				readableStream: new ReadableStream(),
+				contentType: "text/html",
+			})
+		);
+
+		expect(response.status).toBe(404);
+	});
 });