diff --git a/packages/sirv/index.js b/packages/sirv/index.js index fe01068..d1380fe 100644 --- a/packages/sirv/index.js +++ b/packages/sirv/index.js @@ -168,7 +168,7 @@ export default function (dir, opts={}) { extns.push(...extensions); // [...br, ...gz, orig, ...exts] if (pathname.indexOf('%') !== -1) { - try { pathname = decodeURIComponent(pathname) } + try { pathname = decodeURI(pathname) } catch (err) { /* malform uri */ } } diff --git a/tests/sirv.js b/tests/sirv.js index 9aa4597..b258574 100644 --- a/tests/sirv.js +++ b/tests/sirv.js @@ -123,7 +123,7 @@ encode('should work when the request path contains encoded characters :: prod', } }); -encode(`should work when the request path contains space encoded :: dev`, async () => { +encode('should work when the request path contains space encoded :: dev', async () => { let server = utils.http({ dev: true }); try { @@ -136,7 +136,7 @@ encode(`should work when the request path contains space encoded :: dev`, async } }); -encode(`should work when the request path contains space encoded :: prod`, async () => { +encode('should work when the request path contains space encoded :: prod', async () => { let server = utils.http({ dev: false }); try { @@ -149,6 +149,34 @@ encode(`should work when the request path contains space encoded :: prod`, async } }); +encode('should not treat "/foo%2Fbar.txt" the same as "/foo.bar.txt" path :: dev', async () => { + let server = utils.http({ dev: true }); + + try { + let res1 = await server.send('GET', '/about/index.htm'); + assert.is(res1.statusCode, 200); + + let res2 = await server.send('GET', '/about%2Findex.htm').catch(r => r); + assert.is(res2.statusCode, 404); + } finally { + server.close(); + } +}); + +encode('should not treat "/foo%2Fbar.txt" the same as "/foo.bar.txt" path :: prod', async () => { + let server = utils.http({ dev: false }); + + try { + let res1 = await server.send('GET', '/about/index.htm'); + assert.is(res1.statusCode, 200); + + let res2 = await server.send('GET', '/about%2Findex.htm').catch(r => r); + assert.is(res2.statusCode, 404); + } finally { + server.close(); + } +}); + encode.run(); // ---