Route regex mismatch and server gives 500

patheticGeek commented 4 days ago

Astro Info

Astro                    v4.16.13
Node                     v18.20.4
System                   Linux (x64)
Package Manager          npm
Output                   server
Adapter                  @astrojs/node
Integrations             @astrojs/svelte

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

Open the reproduction and go to the following path /products/(select(0)from(select(sleep(15)))v)%2f*'+(select(0)from(select(sleep(15)))v)+'%22+(select(0)from(select(sleep(15)))v)+%22*%2f-9BM4ESb_xARsStc7tdySTQLssA

The server will give 500 with following error:

15:52:26 [ERROR] Missing parameter: id
  Stack trace:
    at /home/withastro/astro/node_modules/astro/dist/core/routing/manifest/generator.js:30:13
    [...] See full stack trace in the browser, or rerun with --verbose.

The reason I found is because in the getParams fn https://github.com/withastro/astro/blob/25baa4ed0c5f55fa85c2c7e2c15848937ed1dc9b/packages/astro/src/core/render/params-and-props.ts#L69-L74

Here decodeURIComponent is used, which should be used to decode URI Components like search params/hash and it incorrectly decodes the above path as - /products/(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/-9BM4ESb_xARsStc7tdySTQLssA

If you notice here there appears a new / and now this has url 3 levels whereas original route that was matched has 2.

Whereas if we use the decodeURI which is to decode the URI itself, then it is correctly decoded as - /products/(select(0)from(select(sleep(15)))v)%2f*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*%2f-9BM4ESb_xARsStc7tdySTQLssA

and this also matches the route regex.