fix(serve-static): add error handler for decoding uri components (#208)

honojs · Oct 28, 2024 · 3dcf537 · 3dcf537
1 parent cd4d4d7
commit 3dcf537
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 1 deletion.
diff --git a/src/serve-static.ts b/src/serve-static.ts
@@ -63,7 +63,14 @@ export const serveStatic = (options: ServeStaticOptions = { root: '' }): Middlew
       return next()
     }
 
-    const filename = options.path ?? decodeURIComponent(c.req.path)
+    let filename: string
+
+    try {
+      filename = options.path ?? decodeURIComponent(c.req.path)
+    } catch {
+      await options.onNotFound?.(c.req.path, c)
+      return next()
+    }
 
     let path = getFilePathWithoutDefaultDocument({
       filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename) : filename,

diff --git a/test/serve-static.test.ts b/test/serve-static.test.ts
@@ -152,6 +152,11 @@ describe('Serve Static Middleware', () => {
     expect(res.status).toBe(404)
   })
 
+  it('Should handle URIError thrown while decoding URI component', async () => {
+    const res = await request(server).get('/static/%c0%afsecret.txt')
+    expect(res.status).toBe(404)
+  })
+
   it('Should handle an extension less files', async () => {
     const res = await request(server).get('/static/extensionless')
     expect(res.status).toBe(200)