fix: remove consecutive slashes (#3882)

A small middleware who will rewrite potential dual slashes to a single slash.
Unleash · May 27, 2023 · 9381b1b · 9381b1b
1 parent 7ef043b
commit 9381b1b
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/src/lib/app.ts b/src/lib/app.ts
@@ -66,6 +66,11 @@ export default async function getApp(
     app.use(compression());
     app.use(cookieParser());
 
+    app.use((req, res, next) => {
+        req.url = req.url.replace(/\/+/g, '/');
+        next();
+    });
+
     app.use(
         `${baseUriPath}/api/admin/features-batch`,
         express.json({ strict: false, limit: '500kB' }),

diff --git a/src/test/e2e/api/auth/leading-slashes-are-stripped.e2e.test.ts b/src/test/e2e/api/auth/leading-slashes-are-stripped.e2e.test.ts
@@ -29,6 +29,11 @@ afterAll(async () => {
     await db.destroy();
 });
 
+test('Access to//api/admin/tags are refused no matter how many leading slashes', async () => {
+    await app.request.get('//api/admin/tags').expect(401);
+    await app.request.get('////api/admin/tags').expect(401);
+});
+
 test('Access to /api/client/features are refused no matter how many leading slashes', async () => {
     await app.request.get('/api/client/features').expect(401);
     await app.request.get('/////api/client/features').expect(401);