expressjs / expressjs/express

Reject routes containing an unescaped space character

Open
#2,511 10 comments 1 reaction 0 assignees View on GitHub
4.x 5.x discuss enhancement module:router
Dominant language
JavaScript
Stars
69.5k
Forks
25k
Avg merge
4d 20h
Merged PRs (30d)
9

Description

At the moment, when the developer provides a route path containing raw characters that must escaped by HTTP clients, for example a space character, the route is registered by express even though it will never match any request (URL):

``` js
var app = express();
app.get('/foo bar', function(req, res) { /* ... */ });

// clients send `GET /foo%20bar`, server responds with 404
```

Such situation is difficult to troubleshoot, especially if the invalid character was included by mistake.

I am proposing to modify Express and/or path-to-regexp to print a warning when a string path argument contains characters that will be always sent in the encoded form by HTTP clients. [RFC3986](https://tools.ietf.org/html/rfc3986#section-2) allows some characters to be sent either encoded or unencoded. Such characters should be accepted as valid (no error/warning).

In other words, only the following characters may be present in the unencoded form:
- Unreserved characters: `ALPHA / DIGIT / "-" / "." / "_" / "~"`
- Reserved characters: `":" / "/" / "?" / "#" / "[" / "]" / "@" / "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="`

@dougwilson thoughts? StrongLoop can contribute the change, I just want to check with you that such change will be accepted.

I was initially thinking that express should throw an error instead of printing a warning, but since such change may be considered as breaking backwards compatibility, it's probably better to stay with the warning.

/cc @PradnyaBaviskar

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.