jawsboot.Setup treats brace-containing prefixes as ServeMux wildcard syntax

[linkdata]

Summary

jawsboot.Setup passes an unescaped asset path to its caller-provided handler registration function. With http.ServeMux.Handle, literal braces in an otherwise valid prefix are interpreted as Go 1.22+ wildcard-pattern syntax instead of URL path characters.

A prefix such as /static{assets} panics during startup. A prefix such as /{assets} can instead register a wildcard and serve assets outside the intended literal prefix.

Class / severity

Robustness / correctness — Medium. Valid configuration can deterministically panic application startup or register overbroad routes.

Contract and valid usage

jawsboot.Setup documents that prefix may be absolute, relative, or empty and says the returned URL path and registered handler path remain identical. It documents no ServeMux-pattern restriction. Braces are valid logical URL-path characters, and passing http.ServeMux.Handle is the normal integration.

Reproduction

func TestSetupLiteralBracePrefix(t *testing.T) {
	jw, err := jaws.New()
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(jw.Close)

	mux := http.NewServeMux()
	if _, err := jawsboot.Setup(jw, mux.Handle, "/static{assets}"); err != nil {
		t.Fatal(err)
	}
}

On Go 1.22+, this panics with:

bad wildcard segment (must start with '{')

Root cause

Returned URLs use url.URL{Path: abspath}, whose string form escapes braces as %7B and %7D. Handler registration instead passes raw abspath through staticserve.NormalizeGET, allowing http.ServeMux to parse the braces as pattern syntax. The sourcemap 404 registrations use the same raw-prefix construction.

Impact

Applications can fail during startup, encounter route conflicts, or expose Bootstrap assets below paths other than the configured literal prefix.

Related issues

#163 fixed empty-prefix URL/handler divergence. This issue concerns URL escaping versus http.ServeMux pattern parsing for non-empty prefixes.

Acceptance criteria

• Register the escaped URL path consistently for every embedded asset and sourcemap 404 route.
• Returned asset URLs and registered literal paths remain equivalent for absolute, relative, and empty prefixes.
• A literal brace-containing prefix neither panics nor creates a wildcard route on Go 1.22+.
• Add regression coverage through a real http.ServeMux.

Confidence

Confirmed on main at 0cada382111e5724806f34037f73b0aadd02b935.