fix(getRequestURL): normalize double slashes

thanks @OhB00 for reporting
unjs · May 15, 2023 · b5d2972 · b5d2972
1 parent d510483
commit b5d2972
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/src/utils/request.ts b/src/utils/request.ts
@@ -100,8 +100,16 @@ export function getRequestProtocol(event: H3Event) {
   return (event.node.req.connection as any).encrypted ? "https" : "http";
 }
 
+const DOUBLE_SLASH_RE = /[/\\]{2,}/g;
+
+export function getRequestPath(event: H3Event) {
+  const path = (event.path || "/").replace(DOUBLE_SLASH_RE, "/");
+  return path;
+}
+
 export function getRequestURL(event: H3Event) {
   const host = getRequestHost(event);
   const protocol = getRequestProtocol(event);
-  return new URL(event.path || "/", `${protocol}://${host}`);
+  const path = getRequestPath(event);
+  return new URL(path, `${protocol}://${host}`);
 }
diff --git a/test/utils.test.ts b/test/utils.test.ts
@@ -97,6 +97,13 @@ describe("", () => {
   describe("getRequestURL", () => {
     const tests = [
       { path: "/foo", url: "http://127.0.0.1/foo" },
+      { path: "//foo", url: "http://127.0.0.1/foo" },
+      { path: "//foo.com//bar", url: "http://127.0.0.1/foo.com/bar" },
+      { path: "///foo", url: "http://127.0.0.1/foo" },
+      { path: "\\foo", url: "http://127.0.0.1/foo" },
+      { path: "\\\\foo", url: "http://127.0.0.1/foo" },
+      { path: "\\/foo", url: "http://127.0.0.1/foo" },
+      { path: "/\\foo", url: "http://127.0.0.1/foo" },
       { path: "/test", host: "example.com", url: "http://example.com/test" },
       {
         path: "/test",