astro 5.16.2 → 5.16.4

package/dist/core/util/pathname.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Validates that a pathname is not multi-level encoded.
+ * Detects if a pathname contains encoding that was encoded again (e.g., %2561dmin where %25 decodes to %).
+ * This prevents double/triple encoding bypasses of security checks.
+ *
+ * @param pathname - The pathname to validate
+ * @returns The decoded pathname if valid
+ * @throws Error if multi-level encoding is detected
+ */
+export declare function validateAndDecodePathname(pathname: string): string;

package/dist/core/util/pathname.js

@@ -0,0 +1,17 @@
+function validateAndDecodePathname(pathname) {
+  let decoded;
+  try {
+    decoded = decodeURI(pathname);
+  } catch (_e) {
+    throw new Error("Invalid URL encoding");
+  }
+  const hasDecoding = decoded !== pathname;
+  const decodedStillHasEncoding = /%[0-9a-fA-F]{2}/.test(decoded);
+  if (hasDecoding && decodedStillHasEncoding) {
+    throw new Error("Multi-level URL encoding is not allowed");
+  }
+  return decoded;
+}
+export {
+  validateAndDecodePathname
+};

package/dist/vite-plugin-astro-server/request.js

@@ -1,5 +1,6 @@
 import { hasFileExtension } from "@astrojs/internal-helpers/path";
 import { appendForwardSlash, removeTrailingForwardSlash } from "../core/path.js";
+import { validateAndDecodePathname } from "../core/util/pathname.js";
 import { runWithErrorHandling } from "./controller.js";
 import { recordServerError } from "./error.js";
 import { handle500Response } from "./response.js";
@@ -18,9 +19,15 @@ async function handleRequest({
   if (config.trailingSlash === "never" && !incomingRequest.url) {
     pathname = "";
   } else {
-    pathname = decodeURI(url.pathname);
+    try {
+      pathname = validateAndDecodePathname(url.pathname);
+    } catch {
+      incomingResponse.writeHead(404, { "Content-Type": "text/plain" });
+      incomingResponse.end("Not Found");
+      return;
+    }
   }
-  url.pathname = removeTrailingForwardSlash(config.base) + decodeURI(url.pathname);
+  url.pathname = removeTrailingForwardSlash(config.base) + pathname;
   if (config.trailingSlash === "never") {
     url.pathname = removeTrailingForwardSlash(url.pathname);
   } else if (config.trailingSlash === "always" && !hasFileExtension(url.pathname)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "5.16.2",
+  "version": "5.16.4",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -154,8 +154,8 @@
     "zod": "^3.25.76",
     "zod-to-json-schema": "^3.25.0",
     "zod-to-ts": "^1.2.0",
-    "@astrojs/markdown-remark": "6.3.9",
     "@astrojs/internal-helpers": "0.7.5",
+    "@astrojs/markdown-remark": "6.3.9",
     "@astrojs/telemetry": "3.3.0"
   },
   "optionalDependencies": {

package/dist/assets/fonts/infra/fs-storage.d.ts

@@ -1,4 +0,0 @@
-import { type Storage } from 'unstorage';
-export declare function createFsStorage({ base }: {
-    base: URL;
-}): Storage;

package/dist/assets/fonts/infra/fs-storage.js

@@ -1,14 +0,0 @@
-import { fileURLToPath } from "node:url";
-import { createStorage } from "unstorage";
-import fsLiteDriver from "unstorage/drivers/fs-lite";
-function createFsStorage({ base }) {
-  return createStorage({
-    // Types are weirly exported
-    driver: fsLiteDriver({
-      base: fileURLToPath(base)
-    })
-  });
-}
-export {
-  createFsStorage
-};

package/dist/assets/fonts/infra/url-proxy-content-resolver.d.ts

@@ -1,3 +0,0 @@
-import type { UrlProxyContentResolver } from '../definitions.js';
-export declare function createLocalUrlProxyContentResolver(): UrlProxyContentResolver;
-export declare function createRemoteUrlProxyContentResolver(): UrlProxyContentResolver;

package/dist/assets/fonts/infra/url-proxy-content-resolver.js

@@ -1,23 +0,0 @@
-import { readFileSync } from "node:fs";
-import { AstroError, AstroErrorData } from "../../../core/errors/index.js";
-function createLocalUrlProxyContentResolver() {
-  return {
-    resolve(url) {
-      try {
-        return url + readFileSync(url, "utf-8");
-      } catch (cause) {
-        throw new AstroError(AstroErrorData.UnknownFilesystemError, { cause });
-      }
-    }
-  };
-}
-function createRemoteUrlProxyContentResolver() {
-  return {
-    // Passthrough, the remote provider URL is enough
-    resolve: (url) => url
-  };
-}
-export {
-  createLocalUrlProxyContentResolver,
-  createRemoteUrlProxyContentResolver
-};