Reject routes containing an unescaped space character
- Dominant language
- JavaScript
- Stars
- 69.5k
- Forks
- 25k
- Avg merge
- 4d 20h
- Merged PRs (30d)
- 9
Description
At the moment, when the developer provides a route path containing raw characters that must escaped by HTTP clients, for example a space character, the route is registered by express even though it will never match any request (URL):
``` js
var app = express();
app.get('/foo bar', function(req, res) { /* ... */ });
// clients send `GET /foo%20bar`, server responds with 404
```
Such situation is difficult to troubleshoot, especially if the invalid character was included by mistake.
I am proposing to modify Express and/or path-to-regexp to print a warning when a string path argument contains characters that will be always sent in the encoded form by HTTP clients. [RFC3986](https://tools.ietf.org/html/rfc3986#section-2) allows some characters to be sent either encoded or unencoded. Such characters should be accepted as valid (no error/warning).
In other words, only the following characters may be present in the unencoded form:
- Unreserved characters: `ALPHA / DIGIT / "-" / "." / "_" / "~"`
- Reserved characters: `":" / "/" / "?" / "#" / "[" / "]" / "@" / "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="`
@dougwilson thoughts? StrongLoop can contribute the change, I just want to check with you that such change will be accepted.
I was initially thinking that express should throw an error instead of printing a warning, but since such change may be considered as breaking backwards compatibility, it's probably better to stay with the warning.
/cc @PradnyaBaviskar
Contributor guide
Assessment
This issue has not been assessed yet.