Got homepage instead of 404 page when using urlSegments

[Lazerproof]

Short description of the issue

Accessing link with adding any special character to the end of URL segment render a home page or causes "Bad request" instead of render 404 page.

Expected behavior

Get 404 page

Actual behavior

With links like
site.com/current-page/real-page/not-real-page)
site.com/current-page/real-page/not-real-page@
Home page is rendered
site.com/current-page/real-page/not-real-page%
I get "Bad request! Your browser (or proxy) sent a request that this server could not understand."

Optional: Screenshots/Links that demonstrate the issue

https://processwire.com/talk/topic/17116-got-home-page-instead-of-404-when-using-urlsegments/

Steps to reproduce the issue

1. Enable URL segments for some template
2. Try to access any URL with adding special char to the end of URL.

Setup/Environment

• ProcessWire version: 3.0.74 and 3.0.73

[ryancramerdesign]

I'm getting a 404 in testing here with those chars appended, regardless of whether the URL maps to a page or a page with URL segments. Is it possible you've got URL segments enabled on the homepage? If so, you probably need to throw the 404 there. The URL with the "%" being a bad request seems correct, so I don't think PW ever gets to even see that one. Here's a couple examples. Everything after "ref" is URL segments:

http://processwire.com/api/ref/page/aelfkjaef@
http://processwire.com/api/ref/aegaeg(

[szabeszg]

I get the same behavior as @Lazerproof and I do not have URL segments enabled on the homepage. I also tried uninstalling some modules but that did not help either.
Currently on ProcessWire 3.0.73, btw.

[Lazerproof]

@ryancramerdesign
I'm getting expected 404 if I uncomment these lines in .htaccess (by default they are commented).

• RewriteCond %{REQUEST_URI} "[^-_.a-zA-Z0-9/~]"
• RewriteCond %{REQUEST_FILENAME} !-f
• RewriteCond %{REQUEST_FILENAME} !-d
• RewriteRule ^(.*)$ index.php?it=/http404/ [L,QSA]

Is there a chance that they are uncommented in your testing environment?

[szabeszg]

"I'm getting expected 404 if I uncomment these lines in .htaccess"
I did it too and can confirm that it "fixes" the issue.

[ryancramerdesign]

I've pushed an update that adds some logic (among other improvements) to ProcessPageView that should correct this issue. Uncommenting that part of the .htaccess file is still more efficient, but similar logic is now on the PHP side too. Please let me know if you continue to see the homepage rather than 404 for any URLs. (The URL that ends with "%" should continue to show bad request).

I couldn't originally reproduce the issue here because my dev environment uses subdirectories. The request was falling back to the root directory with no PW installation, so was just getting 404. Also on the processwire.com site it looks like I do have those .htaccess directives uncommented.

[Lazerproof]

@ryancramerdesign
With the latest update, it works as expected and I get 404. Thanks, Ryan.