decode header to avoid index out of bounds

withastro · Oct 11, 2024 · 6b1d0e8 · 6b1d0e8
1 parent ada0ae6
commit 6b1d0e8
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/packages/astro/src/actions/runtime/middleware.ts b/packages/astro/src/actions/runtime/middleware.ts
@@ -10,6 +10,7 @@ import {
 	type SerializedActionResult,
 	serializeActionResult,
 } from './virtual/shared.js';
+import {getOriginHeader} from "../../core/routing/rewrite.js";
 
 export type ActionPayload = {
 	actionResult: SerializedActionResult;
@@ -136,7 +137,7 @@ async function redirectWithResult({
 		return context.redirect(referer);
 	}
 
-	const referer = context.request.headers.get(ASTRO_ORIGIN_HEADER);
+	const referer = getOriginHeader(context.request);
 	if (referer) {
 		return context.redirect(referer);
 	}

diff --git a/packages/astro/src/core/render-context.ts b/packages/astro/src/core/render-context.ts
@@ -37,7 +37,7 @@ import { callMiddleware } from './middleware/callMiddleware.js';
 import { sequence } from './middleware/index.js';
 import { renderRedirect } from './redirects/render.js';
 import { type Pipeline, Slots, getParams, getProps } from './render/index.js';
-import { copyRequest } from './routing/rewrite.js';
+import {copyRequest, setOriginHeader} from './routing/rewrite.js';
 
 export const apiContextRoutesSymbol = Symbol.for('context.routes');
 
@@ -83,7 +83,7 @@ export class RenderContext {
 			Pick<RenderContext, 'locals' | 'middleware' | 'status' | 'props'>
 		>): Promise<RenderContext> {
 		const pipelineMiddleware = await pipeline.getMiddleware();
-		request.headers.set(ASTRO_ORIGIN_HEADER, pathname);
+		setOriginHeader(request, pathname)
 		return new RenderContext(
 			pipeline,
 			locals,

diff --git a/packages/astro/src/core/routing/rewrite.ts b/packages/astro/src/core/routing/rewrite.ts
@@ -3,6 +3,7 @@ import { shouldAppendForwardSlash } from '../build/util.js';
 import { AstroError, AstroErrorData } from '../errors/index.js';
 import { appendForwardSlash, removeTrailingForwardSlash } from '../path.js';
 import { DEFAULT_404_ROUTE } from './astro-designed-error-pages.js';
+import {ASTRO_ORIGIN_HEADER} from "../constants.js";
 
 export type FindRouteToRewrite = {
 	payload: RewritePayload;
@@ -100,3 +101,15 @@ export function copyRequest(newUrl: URL, oldRequest: Request): Request {
 		duplex: 'half',
 	});
 }
+
+export function setOriginHeader(request: Request, pathname: string): void {
+	request.headers.set(ASTRO_ORIGIN_HEADER, encodeURIComponent(pathname));
+}
+
+export function getOriginHeader(request: Request): string | undefined {
+	const origin = request.headers.get(ASTRO_ORIGIN_HEADER);
+	if (origin) {
+		return decodeURIComponent(origin)
+	}
+	return undefined
+}