@equinor/fusion-framework-module-navigation 7.0.5 → 7.0.7

package/dist/types/NavigationProvider.d.ts

@@ -128,13 +128,21 @@ export declare class NavigationProvider extends BaseModuleProvider<INavigationCo
     /**
      * Checks whether a pathname falls within the configured basename scope.
      *
+     * Uses a path-boundary check to avoid false positives from apps with
+     * overlapping name prefixes (e.g. `/apps/my-app` must not match
+     * `/apps/my-app-other/foo`).
+     *
      * @param pathname - The pathname to check
-     * @returns `true` if the pathname starts with the basename (or no basename is set)
+     * @returns `true` if the pathname matches the basename exactly or starts
+     *          with the basename followed by `/` (or no basename is set)
      */
     protected _isWithinBasenameScope(pathname: string): boolean;
     /**
      * Localizes a path by stripping the basename prefix from the pathname.
      *
+     * Only removes the basename when it matches on a path boundary to avoid
+     * incorrectly stripping partial matches.
+     *
      * @param location - The full path to localize
      * @returns A new {@link Path} with the basename removed from the pathname
      */

package/dist/types/version.d.ts

@@ -1 +1 @@
-export declare const version = "7.0.5";
+export declare const version = "7.0.7";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@equinor/fusion-framework-module-navigation",
-  "version": "7.0.5",
+  "version": "7.0.7",
   "description": "Navigation module for Fusion Framework providing routing and navigation capabilities using React Router 7",
   "sideEffects": false,
   "main": "dist/esm/index.js",
@@ -15,8 +15,8 @@
       "types": "./dist/types/lib/index.d.ts"
     },
     "./utils": {
-      "import": "./dist/esm/utils/index.js",
-      "types": "./dist/types/utils/index.d.ts"
+      "import": "./dist/esm/lib/utils/index.js",
+      "types": "./dist/types/lib/utils/index.d.ts"
     }
   },
   "keywords": [],
@@ -36,19 +36,19 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "jsdom": "^29.0.2",
+    "jsdom": "^30.0.1",
     "rxjs": "^7.8.1",
     "typescript": "^7.0.2",
     "vitest": "^4.1.0",
-    "@equinor/fusion-framework-module": "^6.1.1",
     "@equinor/fusion-framework-module-event": "^6.0.1",
-    "@equinor/fusion-framework-module-telemetry": "^7.0.1",
-    "@equinor/fusion-observable": "^9.1.1"
+    "@equinor/fusion-framework-module": "^6.1.2",
+    "@equinor/fusion-observable": "^9.1.1",
+    "@equinor/fusion-framework-module-telemetry": "^7.0.2"
   },
   "peerDependencies": {
     "@remix-run/router": "^1.0.0",
     "rxjs": "^7.0.0",
-    "@equinor/fusion-framework-module": "^6.1.1",
+    "@equinor/fusion-framework-module": "^6.1.2",
     "@equinor/fusion-observable": "^9.1.1"
   },
   "scripts": {

package/src/NavigationProvider.ts

@@ -24,16 +24,54 @@ import type { BaseHistory } from './lib';
 /**
  * Normalizes a pathname by:
  * - Collapsing multiple consecutive slashes into a single slash
- * - Removing trailing slashes
  *
  * @example
- * normalizePathname("/app//users///profile/") // returns "/app/users/profile"
- * normalizePathname("///multiple///slashes///") // returns "/multiple/slashes"
+ * normalizePathname("/app//users///profile/") // returns "/app/users/profile/"
+ * normalizePathname("///multiple///slashes///") // returns "/multiple/slashes/"
  *
  * @param path - The pathname to normalize
- * @returns The normalized pathname without consecutive or trailing slashes
+ * @returns The normalized pathname without consecutive slashes
  */
-const normalizePathname = (path: string) => path.replace(/\/+/g, '/').replace(/\/$/, '');
+const normalizePathname = (path: string): string => {
+  // Use iterative approach instead of regex to avoid potential ReDoS with untrusted input
+  let result = '';
+  let lastWasSlash = false;
+
+  for (let i = 0; i < path.length; i++) {
+    const char = path[i];
+    if (char === '/') {
+      if (!lastWasSlash) {
+        result += char;
+        lastWasSlash = true;
+      }
+      // Skip consecutive slashes
+    } else {
+      result += char;
+      lastWasSlash = false;
+    }
+  }
+
+  return result;
+};
+
+/**
+ * Removes trailing slashes from a path string.
+ *
+ * @param path - The path to trim
+ * @returns The path without trailing slashes
+ *
+ * @example
+ * stripTrailingSlashes("/apps/my-app/") // returns "/apps/my-app"
+ * stripTrailingSlashes("/apps/my-app///") // returns "/apps/my-app"
+ */
+const stripTrailingSlashes = (path: string): string => {
+  // Use iterative approach to avoid ReDoS vulnerability
+  let endIndex = path.length;
+  while (endIndex > 0 && path[endIndex - 1] === '/') {
+    endIndex--;
+  }
+  return path.substring(0, endIndex);
+};
 
 /**
  * Navigation provider implementation.
@@ -132,13 +170,13 @@ export class NavigationProvider
     // Extract configuration values
     const { basename, history, telemetry, eventProvider } = args.config;
 
-    // Normalize the basename to strip trailing slashes. React Router requires
-    // the current URL to start with the exact basename string, so a basename
-    // of "/apps/my-app/" would fail to match the URL "/apps/my-app" and
-    // render nothing (blank page).
-    // Preserve slash-only basenames (e.g. "/") by falling back to the
-    // original input when normalization collapses to an empty string.
-    this.#basename = basename ? normalizePathname(basename) || basename : basename;
+    // Normalize the basename to strip trailing slashes and collapse consecutive
+    // slashes. React Router requires the current URL to start with the exact
+    // basename string, so a basename of "/apps/my-app/" would fail to match
+    // the URL "/apps/my-app" and render nothing (blank page).
+    // Treat '/' as "no basename" (empty string) since all paths start with '/'.
+    const normalizedBasename = basename ? stripTrailingSlashes(normalizePathname(basename)) : '';
+    this.#basename = normalizedBasename || undefined;
     this.#event = eventProvider;
     this.#telemetry = telemetry;
 
@@ -316,23 +354,58 @@ export class NavigationProvider
   /**
    * Checks whether a pathname falls within the configured basename scope.
    *
+   * Uses a path-boundary check to avoid false positives from apps with
+   * overlapping name prefixes (e.g. `/apps/my-app` must not match
+   * `/apps/my-app-other/foo`).
+   *
    * @param pathname - The pathname to check
-   * @returns `true` if the pathname starts with the basename (or no basename is set)
+   * @returns `true` if the pathname matches the basename exactly or starts
+   *          with the basename followed by `/` (or no basename is set)
    */
   protected _isWithinBasenameScope(pathname: string): boolean {
-    return this.#basename ? pathname.startsWith(this.#basename) : true;
+    // No basename means everything is in scope
+    if (!this.#basename) return true;
+
+    // Normalize the pathname for comparison (collapse consecutive slashes)
+    const normalized = normalizePathname(pathname);
+
+    // Check exact match or path-boundary prefix
+    return normalized === this.#basename || normalized.startsWith(`${this.#basename}/`);
   }
 
   /**
    * Localizes a path by stripping the basename prefix from the pathname.
    *
+   * Only removes the basename when it matches on a path boundary to avoid
+   * incorrectly stripping partial matches.
+   *
    * @param location - The full path to localize
    * @returns A new {@link Path} with the basename removed from the pathname
    */
   protected _localizePath(location: Path): Path {
     const { pathname, search, hash } = location;
+
+    // No basename - return normalized pathname as-is
+    if (!this.#basename) {
+      return {
+        pathname: normalizePathname(pathname) || '/',
+        search,
+        hash,
+      };
+    }
+
+    const normalized = normalizePathname(pathname);
+    let localized = normalized;
+
+    // Strip basename only if it matches at path boundary
+    if (normalized === this.#basename) {
+      localized = '/';
+    } else if (normalized.startsWith(`${this.#basename}/`)) {
+      localized = normalized.slice(this.#basename.length);
+    }
+
     return {
-      pathname: normalizePathname(pathname.replace(this.#basename ?? '', '')),
+      pathname: localized || '/',
       search,
       hash,
     };

package/src/__tests__/NavigationProvider.test.ts

@@ -58,14 +58,245 @@ describe('NavigationProvider', () => {
     expect(disposeSpy).toHaveBeenCalled();
   });
 
-  it('should preserve root basename when set to slash', () => {
+  it('should normalize root basename "/" to empty string', () => {
     const providerWithRootBasename = new NavigationProvider({
       version: '1.0.0',
       config: { history, basename: '/' },
     });
 
-    expect(providerWithRootBasename.basename).toBe('/');
+    // Root basename '/' should be treated as "no basename"
+    expect(providerWithRootBasename.basename).toBe('');
 
     providerWithRootBasename.dispose();
   });
+
+  describe('basename normalization', () => {
+    it('should strip trailing slashes from basename', () => {
+      const provider1 = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app/' },
+      });
+      expect(provider1.basename).toBe('/apps/my-app');
+      provider1.dispose();
+
+      const provider2 = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app///' },
+      });
+      expect(provider2.basename).toBe('/apps/my-app');
+      provider2.dispose();
+    });
+
+    it('should collapse consecutive slashes in basename', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps//my-app' },
+      });
+      expect(provider.basename).toBe('/apps/my-app');
+      provider.dispose();
+    });
+
+    it('should handle pathological input efficiently (ReDoS protection)', () => {
+      // Create a string with many consecutive slashes to test performance
+      // This would cause ReDoS with certain regex patterns
+      const manySlashes = `/apps/${'/'.repeat(10000)}my-app`;
+
+      const startTime = Date.now();
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: manySlashes },
+      });
+      const endTime = Date.now();
+
+      // Should complete in reasonable time (< 100ms for 10k slashes)
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(provider.basename).toBe('/apps/my-app');
+      provider.dispose();
+    });
+
+    it('should handle pathological trailing slashes efficiently (ReDoS protection)', () => {
+      // Create a string with many trailing slashes
+      // The /\/+$/ regex pattern would cause ReDoS with this input
+      const manyTrailingSlashes = `/apps/my-app${'/'.repeat(10000)}`;
+
+      const startTime = Date.now();
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: manyTrailingSlashes },
+      });
+      const endTime = Date.now();
+
+      // Should complete in reasonable time (< 100ms for 10k trailing slashes)
+      expect(endTime - startTime).toBeLessThan(100);
+      expect(provider.basename).toBe('/apps/my-app');
+      provider.dispose();
+    });
+
+    it('should handle undefined basename', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: undefined },
+      });
+      expect(provider.basename).toBe('');
+      provider.dispose();
+    });
+  });
+
+  describe('_isWithinBasenameScope', () => {
+    it('should allow all paths when basename is "/" (no basename)', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/' },
+      });
+
+      // All paths should be in scope
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/')).toBe(true);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps')).toBe(true);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app')).toBe(true);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app/users')).toBe(true);
+
+      provider.dispose();
+    });
+
+    it('should check path boundaries correctly with basename', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app' },
+      });
+
+      // Exact match should be in scope
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app')).toBe(true);
+
+      // Paths starting with basename/ should be in scope
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app/')).toBe(true);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app/users')).toBe(true);
+
+      // Similar but different path should NOT be in scope (path boundary check)
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app-other')).toBe(false);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app-other/users')).toBe(false);
+
+      // Completely different paths should NOT be in scope
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/other')).toBe(false);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/')).toBe(false);
+
+      provider.dispose();
+    });
+
+    it('should handle consecutive slashes in pathname', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app' },
+      });
+
+      // Pathname with consecutive slashes should be normalized
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps//my-app')).toBe(true);
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._isWithinBasenameScope('/apps/my-app//users')).toBe(true);
+
+      provider.dispose();
+    });
+  });
+
+  describe('_localizePath', () => {
+    it('should strip basename from paths on boundary', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app' },
+      });
+
+      // Exact match should become '/'
+      expect(
+        // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+        (provider as any)._localizePath({ pathname: '/apps/my-app', search: '', hash: '' }),
+      ).toEqual({ pathname: '/', search: '', hash: '' });
+
+      // Path with basename prefix should have it stripped
+      expect(
+        // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+        (provider as any)._localizePath({
+          pathname: '/apps/my-app/users',
+          search: '?q=test',
+          hash: '#section',
+        }),
+      ).toEqual({ pathname: '/users', search: '?q=test', hash: '#section' });
+
+      provider.dispose();
+    });
+
+    it('should not strip similar paths without boundary match', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app' },
+      });
+
+      // Path that starts similarly but isn't a real match should not be stripped
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      const result = (provider as any)._localizePath({
+        pathname: '/apps/my-app-other/users',
+        search: '',
+        hash: '',
+      });
+
+      // Should not strip anything since it doesn't match on path boundary
+      expect(result.pathname).toBe('/apps/my-app-other/users');
+
+      provider.dispose();
+    });
+
+    it('should handle root basename "/" correctly', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/' },
+      });
+
+      // With no basename, paths should be returned normalized
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._localizePath({ pathname: '/', search: '', hash: '' })).toEqual({
+        pathname: '/',
+        search: '',
+        hash: '',
+      });
+
+      // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+      expect((provider as any)._localizePath({ pathname: '/apps', search: '', hash: '' })).toEqual({
+        pathname: '/apps',
+        search: '',
+        hash: '',
+      });
+
+      expect(
+        // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+        (provider as any)._localizePath({ pathname: '/apps/my-app', search: '', hash: '' }),
+      ).toEqual({ pathname: '/apps/my-app', search: '', hash: '' });
+
+      provider.dispose();
+    });
+
+    it('should normalize consecutive slashes', () => {
+      const provider = new NavigationProvider({
+        version: '1.0.0',
+        config: { history, basename: '/apps/my-app' },
+      });
+
+      // Consecutive slashes should be collapsed
+      expect(
+        // biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes
+        (provider as any)._localizePath({ pathname: '/apps//my-app//users', search: '', hash: '' }),
+      ).toEqual({ pathname: '/users', search: '', hash: '' });
+
+      provider.dispose();
+    });
+  });
 });

package/src/version.ts

@@ -1,2 +1,2 @@
 // Generated by genversion.
-export const version = '7.0.5';
+export const version = '7.0.7';