fix(astro): guard App.match() against malformed request URIs#16926
Merged
Conversation
🦋 Changeset detectedLatest commit: 2777a3d The changes in this PR will be included in the next version bump. This PR includes changesets to release 401 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
the
pkg: astro
App.match() decodes the request pathname with decodeURI(), which throws URIError: URI malformed when the path contains an invalid percent-sequence that is not valid UTF-8 (e.g. %C0%AF, an overlong-UTF-8 encoding of '/' commonly sent by automated path-traversal and .env scanners). Because matching runs before App.render(), the error escaped the adapter's request handler as an uncaught exception (HTTP 500) that user middleware could not catch. Adapters such as @astrojs/cloudflare call app.match() directly per request, so the worker fetch handler crashed. Add a safeDecodeURI() helper that mirrors the existing guarded decode in getPathnameFromRequest() and use it at all matchRoute/matchAllRoutes call sites. Malformed paths now fall back to the raw pathname and are matched (typically 404) instead of crashing. Fixes withastro#16916
Merging this PR will degrade performance by 27.18%
|
| Mode | Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|---|
| ❌ | Simulation | Rendering: streaming [false], .md file |
1.2 ms | 1.7 ms | -27.18% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing narendraio:fix/app-match-malformed-uri (2777a3d) with main (2c0bc94)
ematipico
approved these changes
Jun 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
App.match()decodes the request pathname withdecodeURI(), which throwsURIError: URI malformedwhen the path contains an invalid percent-sequence that is not valid UTF-8 — e.g.%C0%AF(an overlong-UTF-8 encoding of/, extremely common from automated path-traversal /.envscanners).Because matching runs before
App.render(), the error escaped the adapter's request handler as an uncaught exception (HTTP 500) that user middleware could not catch. Adapters such as@astrojs/cloudflarecallapp.match()directly per request, so the workerfetchhandler crashed.This adds a
safeDecodeURI()helper that mirrors the existing guarded decode already used ingetPathnameFromRequest(), and uses it at allmatchRoute/matchAllRoutescall sites incore/app/base.ts. Malformed paths now fall back to the raw, undecoded pathname and are matched (typically a 404) instead of crashing.Testing
Added
packages/astro/test/units/app/malformed-uri.test.ts:match()does not throw on/%C0%AFand returnsundefinedrender()does not return a 500 for the malformed pathAll app unit tests pass locally (the two unrelated
csrf/loggerunit failures reproduce onmainwithout this change and are environmental).Closes #16916