fix: decodeURI <- decodeURIComponent (#149)

* fix: correctly decode path * chore: add tests --------- Co-authored-by: Luke Edwards <[email protected]>
lukeed · Apr 24, 2023 · dfc4281 · dfc4281
1 parent 52f5dcf
commit dfc4281
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 3 deletions.
diff --git a/packages/sirv/index.js b/packages/sirv/index.js
@@ -172,7 +172,7 @@ export default function (dir, opts={}) {
 		extns.push(...extensions); // [...br, ...gz, orig, ...exts]
 
 		if (pathname.indexOf('%') !== -1) {
-			try { pathname = decodeURIComponent(pathname) }
+			try { pathname = decodeURI(pathname) }
 			catch (err) { /* malform uri */ }
 		}
 

diff --git a/tests/sirv.js b/tests/sirv.js
@@ -123,7 +123,7 @@ encode('should work when the request path contains encoded characters :: prod',
 	}
 });
 
-encode(`should work when the request path contains space encoded :: dev`, async () => {
+encode('should work when the request path contains space encoded :: dev', async () => {
 	let server = utils.http({ dev:  true });
 
 	try {
@@ -136,7 +136,7 @@ encode(`should work when the request path contains space encoded :: dev`, async
 	}
 });
 
-encode(`should work when the request path contains space encoded :: prod`, async () => {
+encode('should work when the request path contains space encoded :: prod', async () => {
 	let server = utils.http({ dev: false });
 
 	try {
@@ -149,6 +149,34 @@ encode(`should work when the request path contains space encoded :: prod`, async
 	}
 });
 
+encode('should not treat "/foo%2Fbar.txt" the same as "/foo.bar.txt" path :: dev', async () => {
+	let server = utils.http({ dev: true });
+
+	try {
+		let res1 = await server.send('GET', '/about/index.htm');
+		assert.is(res1.statusCode, 200);
+
+		let res2 = await server.send('GET', '/about%2Findex.htm').catch(r => r);
+		assert.is(res2.statusCode, 404);
+	} finally {
+		server.close();
+	}
+});
+
+encode('should not treat "/foo%2Fbar.txt" the same as "/foo.bar.txt" path :: prod', async () => {
+	let server = utils.http({ dev: false });
+
+	try {
+		let res1 = await server.send('GET', '/about/index.htm');
+		assert.is(res1.statusCode, 200);
+
+		let res2 = await server.send('GET', '/about%2Findex.htm').catch(r => r);
+		assert.is(res2.statusCode, 404);
+	} finally {
+		server.close();
+	}
+});
+
 encode.run();
 
 // ---