Harden URL pathname normalization to collapse multiple leading slashes#15717
Conversation
🦋 Changeset detectedLatest commit: 1e4c8b5 The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
the
pkg: astro
|
Oh nice, will update. |
|
@ematipico That's for trailing slashes, this is for leading. I'll add a similar utility. |
|
@ematipico added in 0fd0b2f |
| 'astro': patch | ||
| --- | ||
|
|
||
| Hardens URL pathname normalization in the SSR request pipeline to collapse multiple leading slashes before routing and middleware execution |
There was a problem hiding this comment.
Please update this changeset so that it's more use-facing. What we fixed by showing a possible use case
There was a problem hiding this comment.
I wanted to avoid this coming across as alarmist; users should be checking these things in their own middleware, but it's good if we can prevent cases where they do not.
Happy to reword but not sure how to do so.
There was a problem hiding this comment.
I'll give it a try.
2 participants
Changes
//admin→/admin) inremoveBase()and#createNormalizedUrl()context.url.pathnamealways reflects the canonical single-slash form that the router uses for matchingTesting
New unit test suite in
packages/astro/test/units/app/double-slash-bypass.test.jswith 6 testsDocs
N/A, bug fix