@stacksjs/bun-router 0.1.5 → 0.1.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.js +13 -13
- package/dist/utils/decode-param.d.ts +18 -0
- package/package.json +1 -1
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Path params, decoded — once.
|
|
3
|
+
*
|
|
4
|
+
* The matchers took the raw path segment, so `/f/{name}` given
|
|
5
|
+
* `/f/caf%C3%A9` handed the handler the literal `caf%C3%A9`, and a space
|
|
6
|
+
* arrived as `%20`. Every consumer had to decode, which means every consumer
|
|
7
|
+
* that forgot had a bug, and the one framework that remembered
|
|
8
|
+
* (`@stacksjs/router`) had to do it in a wrapper.
|
|
9
|
+
*
|
|
10
|
+
* Doing it here rather than in a wrapper is what makes it exactly once. Two
|
|
11
|
+
* layers each calling `decodeURIComponent` turn `%2520` into a space, and a
|
|
12
|
+
* double decode is how a filter that rejects `../` gets walked past.
|
|
13
|
+
*
|
|
14
|
+
* Note for handlers: a decoded param CAN contain `/` (from `%2F`) — that is
|
|
15
|
+
* the point of encoding it — so anything joining a param into a filesystem
|
|
16
|
+
* path still has to sanitise. Decoding makes the value correct, not safe.
|
|
17
|
+
*/
|
|
18
|
+
export declare function decodeParam(value: string): string;
|