Sanitize paths using @sitecore-jss/sitecore-jss-nextjs

[Lemholt]

Is your suggestion related to a problem? Please describe.

In Sitecore JSS version 22.4.1 using Nextjs, the path argument from context.params.path is directly used in the GraphQL query for fetching the layout. If the path contains any illegal characters, the GraphQL endpoint returns a large error response instead of handling the issue gracefully.

Reproduce by using the following url:
/test%7Cecho tiw4p74lx1 7l2vxhph09%7C%7Ca %23' %7Cecho tiw4p74lx1 7l2vxhph09%7C%7Ca %23%7C" %7Cecho tiw4p74lx1 7l2vxhph09%7C%7Ca %23/test

Describe the solution you'd like

I would like if the sitecore-jss library either prevents malicious paths to be posted to the graphql endpoint or at least sanitizes the path before using it. This can be done either in either the middleware or as part of the graphql request wrapper.

Is there a way to achieve this functionality with exisiting tools?

Using a regex that may be like ' /^/?([a-zA-Z0-9-/]+)$/' could do the trick but as I do not know which specific chars are breaking the graphql endpoint more information is needed.

Additional information

No response

[yavorsk]

Hi @Lemholt thanks, that seems reasonable, we'll discuss it internally, and will create a work item.