fix: return a 400 for malformed URIs

See https://nodejs-org.sentry.io/issues/4622681006/events/3a4e26a6669c46ffb84f20369e90ac8c/
nodejs · Nov 12, 2023 · 4a183bb · 4a183bb
1 parent b854489
commit 4a183bb
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/src/handlers/get.ts b/src/handlers/get.ts
@@ -32,7 +32,17 @@ const getHandler: Handler = async (request, env, ctx, cache) => {
     return responses.BAD_REQUEST;
   }
 
-  const bucketPath = mapUrlPathToBucketPath(requestUrl, env);
+  let bucketPath: string | undefined;
+  try {
+    bucketPath = mapUrlPathToBucketPath(requestUrl, env);
+  } catch (e) {
+    // decodeURIComponent throws a URIError for malformed URIs
+    if (e instanceof URIError) {
+      return responses.BAD_REQUEST;
+    }
+
+    throw e;
+  }
 
   if (typeof bucketPath === 'undefined') {
     // Directory listing is restricted and we're not on

diff --git a/src/util.ts b/src/util.ts
@@ -45,6 +45,7 @@ export function parseUrl(request: Request): URL | undefined {
  * @param env Worker env
  * @returns Mapped path if the resource is accessible, undefined
  *  if the eyeball should not be trying to access the resource
+ * @throws if decodeURIComponet throws a {@link URIError}
  */
 export function mapUrlPathToBucketPath(
   url: URL,