Skip to content

bugFix/TK-4065-handeled-invalid-urls #259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Prajwal17Tunerlabs wants to merge 4 commits into
base: main
Choose a base branch
from
Open

bugFix/TK-4065-handeled-invalid-urls #259

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d095b7a
invalid url fail response handeled
Prajwal17Tunerlabs Apr 1, 2026
be5b438
error message for invalid url updated
Prajwal17Tunerlabs Apr 2, 2026
a731df3
removal of trailing '/' in the url handled
Prajwal17Tunerlabs Apr 28, 2026
e425403
unwanted code removed
Prajwal17Tunerlabs Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion src/utils/patternMatcher.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,21 @@
'use strict'

const removeTrailingSlash = (value) => {
if (typeof value !== 'string') return value
const normalizedValue = value.replace(/[^A-Za-z0-9._~-]+$/g, '')
return normalizedValue || '/'
}
Comment on lines +3 to +7
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Normalize pattern and url consistently, and only strip trailing slashes.

At Line 10 only url is normalized, while Line 13 still builds regex from raw pattern. This can miss matches when a configured sourceRoute ends with / (middleware lookup fails even though router registration still uses sourceRoute). Also, Line 5 currently removes any trailing non-[A-Za-z0-9._~-] chars, not just /, which can alter valid path semantics.

Proposed fix 
 const removeTrailingSlash = (value) => {
-	if (typeof value !== 'string') return value
-	const normalizedValue = value.replace(/[^A-Za-z0-9._~-]+$/g, '')
+	if (typeof value !== 'string') return '/'
+	const normalizedValue = value.replace(/\/+$/g, '')
 	return normalizedValue || '/'
 }

 exports.matchPathsAndExtractParams = (pattern, url) => {
+	const normalizedPattern = removeTrailingSlash(pattern)
 	const normalizedUrl = removeTrailingSlash(url)
 	const paramNames = []
 	const regexPattern = new RegExp(
-		pattern.replace(/\/:(\w+)/g, (_, paramName) => {
+		normalizedPattern.replace(/\/:(\w+)/g, (_, paramName) => {
 			paramNames.push(paramName)
 			return '/([^/]+)'
 		}) + '$'
 	)
 	const matchResult = normalizedUrl.match(regexPattern)

Also applies to: 10-10, 18-18

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/utils/patternMatcher.js` around lines 3 - 7, The helper
removeTrailingSlash currently strips any trailing non-[A-Za-z0-9._~-] chars;
change it to only remove trailing slashes by using value.replace(/\/+$/,'') and
keep the fallback to '/' when result is empty; also ensure you call this
normalization on both the incoming pattern and the url before you build the
RegExp (i.e., normalize the variable named pattern the same way you normalize
url where the regex is constructed) so middleware lookup uses the same route
form as router registration (update all call sites that build the regex from the
raw pattern to use removeTrailingSlash(pattern)).


exports.matchPathsAndExtractParams = (pattern, url) => {
const normalizedUrl = removeTrailingSlash(url)
const paramNames = []
const regexPattern = new RegExp(
pattern.replace(/\/:(\w+)/g, (_, paramName) => {
paramNames.push(paramName)
return '/([^/]+)'
}) + '$'
)
const matchResult = url.match(regexPattern)
const matchResult = normalizedUrl.match(regexPattern)
if (!matchResult) return false
const params = {}
for (let i = 0; i < paramNames.length; i++) {
Expand Down