Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Malformed URI crashes polka #119

Closed
dekdevy opened this issue Nov 20, 2019 · 3 comments
Closed

Malformed URI crashes polka #119

dekdevy opened this issue Nov 20, 2019 · 3 comments
Labels
has fix

Comments

@dekdevy
Copy link

dekdevy commented Nov 20, 2019

Version: ^1.0.0-next.7

const polka = require('polka')
const app = polka()
app.listen(1234)

Then do a GET to http://localhost:1234/%2

Polka crashes:

url = req.url = obj.href = obj.path = obj.pathname = obj._raw = decodeURIComponent(url);                                                                                              ^
URIError: URI malformed
    at decodeURIComponent

How do I catch or fix this? 0.54 does not crash, btw. It ends with 400.
lukeed added a commit that referenced this issue Nov 21, 2019
@lukeed
fix(url): catch malformed URI on decode;
0368b68 
- Closes #119
@lukeed lukeed added the has fix label Nov 21, 2019
@lukeed
Copy link
Owner

lukeed commented Nov 21, 2019

Thanks! Fixed and now releasing

@dekdevy
Copy link
Author

dekdevy commented Nov 21, 2019

Thanks for the quick fix. I noticed sirv uses this file too and therefore is also subject to the same error, btw.

@dekdevy dekdevy mentioned this issue Nov 21, 2019
Closed
lukeed added a commit to lukeed/sirv that referenced this issue Nov 23, 2019
@lukeed
chore(sirv): update polka/url dep;
db8fefc 
lukeed/polka#119
@lukeed
Copy link
Owner

lukeed commented Nov 23, 2019

Thanks, fixed in sriv@next since its latest isn't using the polka/url@next 👍

@lukeed lukeed closed this as completed Nov 23, 2019
lukeed added a commit to lukeed/sirv that referenced this issue Jun 10, 2020
@lukeed @developit @pR0Ps
Major: 1.0 (#64)
bb948a7 
* chore(sirv): bump “@polka/url” for better decoding

* feat(sirv): inline `opts.single` behavior

* fix(sirv): unknown Content-Type as empty string

* feat(sirv-cli): run HTTP/2 server behind flags

* chore(sirv-cli): update readme

* feat: run `sade` in single-command mode

* feat(sirv): allow `--single` to accept path;

- Closes #35

* fix(sirv): respect existing `Content-Type` header;

- Closes #38
- Closes #39

* fix(sirv-cli): use "-K" for `--http2` alias

* feat: allow precompiled gzip & brotli files;

- Closes #3

* refactor(sirv): consolidate "dev & prod" modes;

- still optimized
- adds ETag support to "dev" mode
- adds brotli/gzip support to "dev" mode
- Related: #3

* chore: bump devdeps

* v1.0.0-next.0

* chore(docs): fix Polka demo usage;

- Closes #42

* fix(sirv): set "no-store" during `dev` mode;

- Closes #45

* v1.0.0-next.1

* fix(sirv): extract `list` into package

* fix(sirv): ignore deeply-nested dotfiles too

* chore(sirv): update `polka/url` dep;

lukeed/polka#119

* v1.0.0-next.2

* feat(sirv-cli): add `--pass` flag for passphrase

* v1.0.0-next.3

* fix(sirv): compare `ETag` against `If-None-Match` header (#56)

* fix(sirv-cli): use `host` for port availability

* Add support for ETag-based caching

When providing an ETag header on responses, the client automatically sends that header value on subsequent requests for the matching resource as an `If-None-Match` request header. If the ETag value received in `If-None-Match` is the same as the ETag computed by the disk crawl, a 304 "Not Modified" status can be returned along with an empty body to indicate that the requestor's cached value should be used.

* chore: use existing `isEtag` var

Co-authored-by: Luke Edwards <luke.edwards05@gmail.com>

* chore(sirv): squash declaration

* v1.0.0-next.4

* break: require Node 10.x minimum;

- Node 8.x is already End of Life (2019-12-31)

* v1.0.0-next.5

* feat(sirv): add type definitions;

- Closes #61

* chore: add `notice` to base readme re: website;

- Closes #62

* feat(sirv): add `filter` option to determine file list;

- supplants default `dotfiles` matcher, responsible for own logic
- Closes #50

* fix(sirv): replace `filter` w/ built-in ".well-known" allowance;

- Closes #50

* chore: rename files

* chore(sirv-cli): rename `boot` file

* chore(sirv): produce `build` files w/ "module" entry

* chore: run tests with esm loader

* chore: re-extract `middleware` helper file

* chore: begin integration test suites;

- include fixtures directory

* chore: use `pnpm` again for lerna;

This reverts commit a56872b.

# Conflicts:
#	lerna.json

* chore(action): install `pnpm` for ci

* chore: add `single` tests

* chore(action): use `curl` installer for pnpm

* chore: add "extensions" tests

* chore: add `dotfiles` test suite

* chore: add `dev` test suite

* chore: add `etag` test suite

* chore: add `brotli` and `gzip` suites

* chore: add `maxAge` and `immutable` test suites

* chore: add `ranges` test suite

* fix(test): remove `only` on dotfiles suite

* chore: import `setHeaders` and `onNoMatch` suites

* chore: cleanup test helpers

* chore: include "build" step in CI

* chore: initial CLI tests

* revert: allow normal resolution

* chore: try `actions/cache` recipe

* chore: add loose CLI tests

* fix(test): terminate child procs correctly

* chore: boot `http2` server within test

* fix(sirv): normalize encoded/accented characters for cache

* debug: server spawner really annoying

* feat: add "assets" option (#53)

* Add option to specify asset paths for SPAs

Allows asset path prefixes to be specified by the CLI when running in
single-page mode.

If a path is requested that doesn't exist, and that path matches one of
the asset path prefixes, the request will 404 instead of retuning a 200
containing the root index.

Fixes #44

* fix: ensure `assets` array & preload prep work

* chore: add `assets` tests

* chore: update options definition

* update `--single` & `--assets` text

Co-authored-by: Luke Edwards <luke.edwards05@gmail.com>

* refactor: rename "assets" to "ignores" option

* fix: include dotfiles & well-known in default ignores

* fix: move `ignores` check into `toAssume` builder

* refactor: hoist bound `lookup` function

* fix(sirv): do not fill cache when `dev` true

* v1.0.0-next.6

* fix(sirv): extension regexp

* v1.0.0-next.7

* fix(sirv): remove premature ignore check;

- ran before extensions could be applied
- effectively reverts to #53

* v1.0.0-next.8

* fix(sirv): allow definition to export type members

* v1.0.0-next.9

* fix(sirv): dedupe extensions list w/ brotli + gzip

* chore: update documentation

* chore: update bench figures;

- include dummy apps directly

* chore: fix spacing

Co-authored-by: Jason Miller <developit@users.noreply.github.com>
Co-authored-by: Carey Metcalfe <carey@cmetcalfe.ca>
@andykais andykais mentioned this issue Jun 23, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
has fix
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lukeed @dekdevy