Skip to content

fix(web): show 404 for invalid browse paths #1546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
brendan-kellam wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(web): show 404 for invalid browse paths #1546

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b4e05bb
fix(web): show 404 for invalid browse paths
brendan-kellam Aug 5, 2026
0012be8
docs: add changelog entry for #1546
brendan-kellam Aug 5, 2026
a8d54d0
fix(web): validate browse paths on the server
brendan-kellam Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- Upgraded `socket.io-parser` to `^4.2.7`. [#1542](https://github.com/sourcebot-dev/sourcebot/pull/1542)
- Upgraded `fast-uri` to `^3.1.5`. [#1541](https://github.com/sourcebot-dev/sourcebot/pull/1541)
- Upgraded `ip-address` to `^10.4.0`. [#1540](https://github.com/sourcebot-dev/sourcebot/pull/1540)
- Fixed invalid browse paths returning service errors instead of the 404 page. [#1546](https://github.com/sourcebot-dev/sourcebot/pull/1546)

## [5.1.5] - 2026-07-31

Expand Down
32 changes: 32 additions & 0 deletions packages/web/src/app/(app)/browse/[...path]/layout.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
import { getConfiguredLanguageModelsInfo } from "@/features/chat/utils.server";
import { notFound } from "next/navigation";
import { getBrowseParamsFromPathParam } from "../hooks/utils";
import { LayoutClient } from "../layoutClient";

interface LayoutProps {
children: React.ReactNode;
params: Promise<{
path: string[];
}>;
}

export default async function Layout({
children,
params,
}: LayoutProps) {
const { path } = await params;
const browseParams = getBrowseParamsFromPathParam(path.join('/'));
Comment on lines +17 to +18

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Repo files matching layout/params:"
git ls-files | rg '(^|/)layout\.tsx$|getBrowseParamsFromPathParam|browseParams|routeMatchers|route-matcher' || true

echo
echo "Target file excerpt:"
if [ -f packages/web/src/app/'(app)'/browse/[...path]/layout.tsx ]; then
  cat -n 'packages/web/src/app/(app)/browse/[...path]/layout.tsx'
else
  fd -a 'layout.tsx' packages/web/src/app | sed -n '1,80p'
fi

echo
echo "Find getBrowseParamsFromPathParam definitions/usages:"
rg -n "getBrowseParamsFromPathParam|BrowseParams|decodeURIComponent|encodeURIComponent|notFound\(" packages/web/src -S || true

echo
echo "Next.js version declarations:"
for f in package.json packages/web/package.json pnpm-lock.yaml package-lock.json yarn.lock bun.lockb; do
  [ -f "$f" ] && { echo "--- $f"; sed -n '1,180p' "$f" | rg -n '"next"|"`@next/`"|next@|next:' || true; }
done

Repository: sourcebot-dev/sourcebot

Length of output: 24523

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Source hook utils:"
cat -n 'packages/web/src/app/(app)/browse/hooks/utils.ts' | sed -n '1,120p'

echo
echo "Tests for decoding-related cases:"
cat -n 'packages/web/src/app/(app)/browse/hooks/utils.test.ts' | sed -n '1,130p'

echo
echo "Inspect Next.js route matcher from declared lockfile / source if available:"
if [ -f node_modules/next/package.json ]; then
  node - <<'JS'
const p = require('/app/node_modules/next/package.json');
console.log(JSON.stringify({next: p.version}, null, 2));
JS
  rg -n "decodeURIComponent|route-matcher|routeMatcher" node_modules/next -S -m 20 || true
else
  echo "node_modules/next/package.json not present"
fi

echo
echo "Try NPM registry source bundle for declared next patch version:"
tmp="$(mktemp -d)"
cd "$tmp"
set +e
npm pack next@16.2.6 --json 2>/dev/null | jq -r '.[0].filename' 2>/dev/null || true
tarball="$(npm pack next@16.2.6 2>/dev/null | tail -n 1)"
if [ -n "$tarball" ] && [ -f "$tarball" ]; then
  tar -xzf "$tarball"
  echo "--- package files matching route matcher/decode:"
  find package -type f | rg 'path/dist/shared/lib/router/utils/route-matcher|route-matcher|decodeURIComponent' || true
  echo "--- source contains decodeURIComponent:"
  rg -n "decodeURIComponent|decode =? function|decodeURIComponentOnce|decodeURI" package -S -m 40 || true
fi

Repository: sourcebot-dev/sourcebot

Length of output: 12150

🌐 Web query:

Next.js 16.2.11 routeMatcher parameter decodeURIComponent repeated catch-all route parameters source route-matcher

💡 Result:

In Next.js, including version 16.2.11, the route matcher process extracts dynamic route parameters from the URL path. These parameters are URL-encoded by nature when they originate from the request URL. To ensure that parameters are usable as expected (e.g., converting %20 back to a space), the framework applies decodeURIComponent to these matched segments. When handling catch-all routes (e.g., [...slug]), the framework processes each individual element of the catch-all array by applying decoding [1]. A known technical challenge in this process is the risk of double-encoding or decoding errors, particularly when a path segment is already decoded or contains characters that might cause decodeURIComponent to throw an error (such as malformed percent-encoded sequences or already decoded path delimiters) [2]. To handle these cases robustly, the standard implementation pattern in Next.js—often observed in its routing and middleware utilities—involves wrapping the decoding process in a try-catch block [3][4]: try { return decodeURIComponent(param) } catch { // If decoding fails (e.g., param is already decoded or contains invalid sequences), // return the parameter as-is to preserve the original value. return param } This defensive approach prevents application crashes due to malformed URI components while ensuring that properly encoded parameters are correctly normalized for use in the application, such as in router.query or useParams hooks [1]. Ongoing refinements in the Next.js routing layer continue to address edge cases where path delimiters (like slashes or encoded equivalents) interact with this decoding logic, especially regarding middleware behavior and base path rewrites [5][6].

Citations:

🌐 Web query:

github vercel next.js 16.2.6 packages next src shared lib router utils route matcher decodeURIComponent params

💡 Result:

In Next.js, the route-matcher utility is located in packages/next/src/shared/lib/router/utils/route-matcher.ts [1][2]. This utility is responsible for matching request paths against dynamic routes and extracting parameters [3][2]. The getRouteMatcher function inside this file defines a decode helper that uses decodeURIComponent to process path parameters captured by regular expressions [2]. When a dynamic route is matched, the matcher iterates through the identified groups (parameters) and applies this decode function to each value [2]. If a parameter is marked as a repeatable segment (using rest parameters like [...slug]), it splits the string by / and decodes each part individually [2]. Historically, this area of the codebase has been sensitive to how parameters are encoded, leading to issues such as double-decoding or failure when encountering special characters like % [4][5][6]. The implementation specifically includes a try-catch block around decodeURIComponent to handle scenarios where the input might be invalid, throwing a custom DecodeError: failed to decode param if decoding fails [2]. Next.js version 16.2.6, released in May 2026, was a significant security release that addressed multiple vulnerabilities, including those related to middleware/proxy bypass through dynamic route parameter injection (e.g., GHSA-492v-c6pp-mqqv) [7][8][9]. While version 16.2.6 does not focus solely on route-matcher, the routing and parameter handling logic remain foundational components of the App Router and Pages Router functionality within the next package [1][3].

Citations:

🌐 Web query:

github vercel next.js v16.2.11 routeMatcher.ts decodeURIComponent

💡 Result:

In Next.js, particularly within files like routeMatcher.ts, the use of decodeURIComponent is a frequent point of interaction for handling URL path segments [1][2][3]. The handling of decodeURIComponent in the Next.js router has evolved to address several critical issues: 1. Handling Non-ASCII Characters: Earlier updates introduced logic in route-matcher.ts to attempt decoding of pathnames to properly match route definitions, allowing for non-ASCII path names (e.g., Unicode characters) that might otherwise return 404 errors [1]. 2. Robustness Against Invalid Sequences: Next.js has implemented specific error handling for cases where a URL segment contains invalid percent-encoded sequences (e.g., %A0). Instead of allowing a URIError to propagate and cause a 500 server error, the router catches these cases and correctly returns a 404 Not Found status [2]. 3. Preventing Encoding Errors: There has been historical work to ensure that parameters are not double-encoded or improperly decoded. Developers have noted that applying decodeURIComponent directly can fail if the input is already partially decoded or contains characters like %25, leading to recommendations for safe, try-catch based approaches when manually handling these values in user-land code [3][4]. Regarding Next.js version 16.2.11, released on July 21, 2026, the primary focus was on addressing several high-severity security vulnerabilities, including issues related to Server Actions, Middleware, and SSRF [5][6][7]. While the core router files like routeMatcher.ts continue to refine how they handle URI decoding to maintain stability and security, version 16.2.11 is specifically characterized by these security patches rather than a direct, major overhaul of the route matcher's decoding logic [5][8][9].

Citations:

🌐 Web query:

raw.githubusercontent.com vercel/next.js v16.2.11 packages next src shared lib router utils route-matcher.ts decodeURIComponent decode function

💡 Result:

In the Next.js source code (such as in v16.2.11), the getRouteMatcher function located in packages/next/src/shared/lib/router/utils/route-matcher.ts uses the decodeURIComponent function to decode dynamic route parameters [1]. When a path is matched against a route, the getRouteMatcher creates a helper decode function that wraps decodeURIComponent in a try...catch block [1]. If decodeURIComponent fails (for example, due to a malformed percent-encoded sequence), it throws a DecodeError (custom error) with the message "failed to decode param" [1][2]. This mechanism ensures that captured dynamic segments—whether they are single parameters or elements of a catch-all route—are properly URL-decoded before being processed by the application [1][3]. If decoding fails, recent versions of Next.js are designed to handle the error, typically resulting in a 404 response rather than allowing the error to propagate as a 500 server error [2][4].

Citations:

🌐 Web query:

raw.githubusercontent.com vercel/next.js v16.2.6 packages next src shared lib router utils route-matcher.ts decodeURIComponent decode function

💡 Result:

In Next.js version 16.2.6, the route matcher logic found in packages/next/src/shared/lib/router/utils/route-matcher.ts uses decodeURIComponent to process URL path segments when matching dynamic routes [1][2]. The use of decodeURIComponent in this utility has historically been a source of errors when URLs contain invalid percent-encoded sequences (e.g., %A0) or when paths are double-encoded [3][4][5]. When decodeURIComponent encounters a malformed URI sequence, it throws a URIError. Within the Next.js router, this error is typically wrapped or handled to ensure the application does not crash with a 500 error [2][6]. Recent improvements and fixes in the Next.js routing infrastructure—specifically around the 16.x release cycle—have focused on making this decoding process more resilient [2][7][6]. Notably, if a segment cannot be decoded, modern versions of the router are designed to catch the resulting DecodeError and treat it as a non-match (resulting in a 404 Not Found response) rather than allowing the error to propagate or trigger an incorrect status code [2][6]. This prevents issues where invalid encoding in a URL segment could inadvertently cause server-side exceptions [2][6].

Citations:

🌐 Web query:

raw.githubusercontent.com vercel/next.js v16.2.6 packages/next/src/shared/lib/router/utils/route-matcher.ts "for (const segment of restSegments)" decodeURIComponent

💡 Result:

In Next.js v16.2.6, the file located at packages/next/src/shared/lib/router/utils/route-matcher.ts is responsible for matching URL path segments against defined routes [1][2]. The use of decodeURIComponent within this module—specifically when iterating over path segments—is a critical part of how Next.js handles dynamic route parameters [2]. Historically, this logic has been a focus for reliability improvements to prevent unhandled errors and handle edge cases in URI decoding [3][4][5]. Key technical context for this implementation includes: 1. Handling Invalid Encoding: When a URL segment contains a percent-encoded sequence that cannot be decoded (e.g., %A0), decodeURIComponent throws a URIError [3]. In modern versions of Next.js, this is often wrapped or handled to ensure the framework returns a 404 Not Found instead of a 500 error, as an un-decodable segment is treated as a non-match for the route [3]. 2. Preventing Double Decoding and Errors: Next.js has evolved to ensure that parameters are decoded safely [6][2]. Because the router might encounter segments that have already been processed, careless use of decodeURIComponent can lead to errors if it attempts to decode an already-decoded string or handles malformed input [6][5]. The implementation typically involves try-catch blocks around decodeURIComponent to allow the router to fall back gracefully if a segment is invalid or already decoded [6]. 3. Support for Special Characters: Using decodeURIComponent allows dynamic route parameters (like [slug]) to correctly capture and provide literal values for encoded characters (e.g., converting %20 to a space or %2F to a slash where appropriate), ensuring consistent behavior across different router configurations [2]. For exact source code visualization, you can view the repository at github.com/vercel/next.js/tree/v16.2.6, though direct access to internal source files via raw.githubusercontent.com URLs is subject to GitHub's raw file serving policies and specific repository branch structures [7][8].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

tmp="$(mktemp -d || true)"
if [ -n "${tmp:-}" ]; then
  echo "Checking next@16.2.6 package metadata/source fetch:"
  (set +e; npm view next@16.2.6 version dist.tarball dist.integrity 2>&1)
  tarball="$(npm pack next@16.2.6 2>/dev/null | tail -n 1)"
  if [ -n "${tarball:-}" ] && [ -f "$tarball" ]; then
    tar -xzf "$tarball"
    echo "--- route-matcher matches:"
    grep -RIn "decodeURIComponent|restSegments|for \\(const segment of restSegments\\)" package/dist package/src 2>/dev/null | head -80 || true
    echo "--- inspect candidate source:"
    for f in package/src/shared/lib/router/utils/route-matcher.ts package/dist/server/route-matchers/next.js package/dist/esm/shared/lib/router/utils/route-matcher.js; do
      if [ -f "$f" ]; then
        echo "### $f"
        sed -n '1,180p' "$f"
      fi
    done
    echo "--- inspect compiled route-matchers if present:"
    f="package/dist/server/route-matchers/route-matcher.js"
    if [ -f "$f" ]; then
      sed -n '1,220p' "$f"
    fi
  fi
fi

echo
echo "Programmatic probe of getBrowseParamsFromPathParam decoding behavior for route-param decoded shapes:"
node - <<'JS'
function decodeBrowsePathPart(pathPart) {
  try {
    return decodeURIComponent(pathPart);
  } catch {
    return null;
  }
}

function getDecodeShapeFor(urlOrEncoded) {
  // Simulate Next.js catch-all repeated segments decoded before rejoining plus slash normalization.
  // This is not full Next router matching; it only shows the decoded string the parser receives
  // for the stated examples in the review.
  if (urlOrEncoded.includes('/-/')) return urlOrEncoded;
  const match = urlOrEncoded.match(/^([^/]+)\/([^/]+)\/-(\/[a-zA-Z0-9-_\/]+)$/);
  if (!match) return null;
  const repoAndRevisionPart = decodeURIComponent(match[1]) + '/' + decodeURIComponent(match[2]) || '';
  const pathPart = '/' + decodeURIComponent(match[3]).replace(/\/+/g, '/').replace(/^\/+/, '');
  return repoAndRevisionPart + '/-/tree' + pathPart;
}

const tests = [
  '100%.txt',
  '/-/tree/100%.txt',
  'github.com/repo@HEAD/-/tree/100%.txt',
  'github.com/repo@HEAD/-/blob/%25hello%25%2Fworld.c',
];
for (const input of tests) {
  const shape = getDecodeShapeFor(input);
  console.log(JSON.stringify({ input, shape, parserParsed: getBrowseParamsFromPathParam(shape ? shape : input) })
    // Since getBrowseParamsFromPathParam is not exported to Node, just log parsing decision point inputs instead.
  );
}
JS

Repository: sourcebot-dev/sourcebot

Length of output: 4620

Preserve URL encoding at the Next.js route boundary.

Next.js decodes each catch-all route segment before returning params.path, but getBrowseParamsFromPathParam() decodes the joined string again. A path such as 100%.txt can then fail decodeURIComponent(), and legitimate %2F path components are decoded twice. Add an already-decoded parser entry point or encode before joining route segments for this layout/page path.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/web/src/app/`(app)/browse/[...path]/layout.tsx around lines 17 - 18,
Update the route handling around getBrowseParamsFromPathParam so Next.js-decoded
catch-all segments are not decoded a second time. Use an entry point that
accepts already-decoded path data, or re-encode segments before joining them,
while preserving literal percent characters and encoded slash components.

Source: MCP tools

if (!browseParams) {
notFound();
}

const languageModels = await getConfiguredLanguageModelsInfo();
return (
<LayoutClient
browseParams={browseParams}
isSearchAssistSupported={languageModels.length > 0}
>
{children}
</LayoutClient>
)
}
10 changes: 9 additions & 1 deletion packages/web/src/app/(app)/browse/[...path]/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import { CommitsPanel } from "./components/commitHistoryPanel/commitsPanel";
import { Loader2 } from "lucide-react";
import { TreePreviewPanel } from "./components/treePreviewPanel/treePreviewPanel";
import { Metadata } from "next";
import { notFound } from "next/navigation";
import { TrackRepoVisit } from "./components/trackRepoVisit";
import { auth } from "@/auth";

Expand All @@ -24,6 +25,10 @@ const parsePathForTitle = (path: string[]): string => {
const pathParam = path.join('/');

const browseProps = getBrowseParamsFromPathParam(pathParam);
if (!browseProps) {
return 'Browse';
}

const { repoName, revisionName, path: filePath } = browseProps;

// Build the base repository and revision string.
Expand Down Expand Up @@ -104,6 +109,10 @@ export default async function BrowsePage(props: BrowsePageProps) {

const rawPath = _rawPath.join('/');
const browseProps = getBrowseParamsFromPathParam(rawPath);
if (!browseProps) {
notFound();
}

const { repoName, revisionName, path } = browseProps;

const page = Math.max(1, parseInt(searchParams.page ?? '1', 10) || 1);
Expand Down Expand Up @@ -166,4 +175,3 @@ export default async function BrowsePage(props: BrowsePageProps) {
</div>
)
}

23 changes: 9 additions & 14 deletions packages/web/src/app/(app)/browse/hooks/useBrowseParams.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,13 @@
import { usePathname } from "next/navigation";
import { useMemo } from "react";
import { getBrowseParamsFromPathParam } from "./utils";
import { createContext, useContext } from "react";
import type { BrowseProps } from "./utils";

export const useBrowseParams = () => {
const pathname = usePathname();
export const BrowseParamsContext = createContext<BrowseProps | null>(null);

return useMemo(() => {
const startIndex = pathname.indexOf('/browse/');
if (startIndex === -1) {
throw new Error(`Invalid browse pathname: "${pathname}" - expected to contain "/browse/"`);
}
export const useBrowseParams = () => {
const browseParams = useContext(BrowseParamsContext);
if (!browseParams) {
throw new Error('useBrowseParams must be used within a BrowseParamsContext provider');
}

const rawPath = pathname.substring(startIndex + '/browse/'.length);
return getBrowseParamsFromPathParam(rawPath);
}, [pathname]);
return browseParams;
}

77 changes: 52 additions & 25 deletions packages/web/src/app/(app)/browse/hooks/utils.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,29 @@ describe('getBrowseParamsFromPathParam', () => {
});
});

describe('history paths', () => {
it('should parse a commits path', () => {
const result = getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/commits/packages/web');
expect(result).toEqual({
repoName: 'github.com/sourcebot-dev/zoekt',
revisionName: 'HEAD',
path: 'packages/web',
pathType: 'commits',
});
});

it('should parse a commit path', () => {
const result = getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt/-/commit/a1b2c3d');
expect(result).toEqual({
repoName: 'github.com/sourcebot-dev/zoekt',
revisionName: undefined,
path: '',
pathType: 'commit',
commitSha: 'a1b2c3d',
});
});
});

describe('edge cases', () => {
it('should handle repo name with multiple @ symbols', () => {
const result = getBrowseParamsFromPathParam('gitlab.com/user@domain/repo@main/-/tree/');
Expand All @@ -175,40 +198,44 @@ describe('getBrowseParamsFromPathParam', () => {
});

describe('error cases', () => {
it('should throw error for blob path with trailing slash and no path', () => {
expect(() => {
getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/blob/');
}).toThrow();
it('should return null for blob path with trailing slash and no path', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/blob/')).toBeNull();
});

it('should return null for blob path without trailing slash and no path', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/blob')).toBeNull();
});

it('should return null for invalid pattern - missing /-/', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/tree/')).toBeNull();
});

it('should return null for invalid pattern - missing tree/blob', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/invalid/')).toBeNull();
});

it('should return null for completely invalid format', () => {
expect(getBrowseParamsFromPathParam('invalid-path')).toBeNull();
});

it('should throw error for blob path without trailing slash and no path', () => {
expect(() => {
getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/blob');
}).toThrow();
it('should return null for empty string', () => {
expect(getBrowseParamsFromPathParam('')).toBeNull();
});

it('should throw error for invalid pattern - missing /-/', () => {
expect(() => {
getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/tree/');
}).toThrow();
it('should return null for an empty repository name', () => {
expect(getBrowseParamsFromPathParam('/-/tree')).toBeNull();
});

it('should throw error for invalid pattern - missing tree/blob', () => {
expect(() => {
getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/invalid/');
}).toThrow();
it('should return null for a commit path without a SHA', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt/-/commit')).toBeNull();
});

it('should throw error for completely invalid format', () => {
expect(() => {
getBrowseParamsFromPathParam('invalid-path');
}).toThrow();
it('should return null for invalid URL encoding', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/blob/%')).toBeNull();
});

it('should throw error for empty string', () => {
expect(() => {
getBrowseParamsFromPathParam('');
}).toThrow();
it('should return null when the browse type is only a prefix', () => {
expect(getBrowseParamsFromPathParam('github.com/sourcebot-dev/zoekt@HEAD/-/treehouse')).toBeNull();
});
});
});
});
68 changes: 35 additions & 33 deletions packages/web/src/app/(app)/browse/hooks/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,65 +59,68 @@ export type BrowsePathType = BrowseProps['pathType'];
// both map to the empty path.
const normalizeRepoPath = (path: string): string => path.replace(/^\/+/, '');

export const getBrowseParamsFromPathParam = (pathParam: string): BrowseProps => {
// @note: order matters — `commits` must come before `commit` so the regex
// engine doesn't greedily match `commit` against `/-/commits/...`.
const sentinelIndex = pathParam.search(/\/-\/(tree|blob|commits|commit)/);
if (sentinelIndex === -1) {
throw new Error(`Invalid browse pathname: "${pathParam}" - expected to contain "/-/(tree|blob|commits|commit)/" pattern`);
const decodeBrowsePathPart = (pathPart: string): string | null => {
try {
return decodeURIComponent(pathPart);
} catch {
return null;
}
};

export const getBrowseParamsFromPathParam = (pathParam: string): BrowseProps | null => {
const sentinelMatch = pathParam.match(/\/-\/(tree|blob|commits|commit)(?:\/|$)/);
if (!sentinelMatch || sentinelMatch.index === undefined) {
return null;
}

const sentinelIndex = sentinelMatch.index;
const repoAndRevisionPart = decodeBrowsePathPart(pathParam.substring(0, sentinelIndex));
if (repoAndRevisionPart === null) {
return null;
}

const repoAndRevisionPart = decodeURIComponent(pathParam.substring(0, sentinelIndex));
const lastAtIndex = repoAndRevisionPart.lastIndexOf('@');

const repoName = lastAtIndex === -1 ? repoAndRevisionPart : repoAndRevisionPart.substring(0, lastAtIndex);
const revisionName = lastAtIndex === -1 ? undefined : repoAndRevisionPart.substring(lastAtIndex + 1);
if (!repoName) {
return null;
}

const tail = pathParam.substring(sentinelIndex + '/-/'.length);
const pathType = ((): BrowsePathType => {
if (tail.startsWith('tree')) {
return 'tree';
}
else if (tail.startsWith('commits')) {
return 'commits';
}
else if (tail.startsWith('commit')) {
return 'commit';
}

return 'blob';
})();
const pathType = sentinelMatch[1] as BrowsePathType;
const tail = pathParam.substring(sentinelIndex + '/-/'.length + pathType.length);
const pathPart = tail.startsWith('/') ? tail.substring(1) : tail;
const decodedPathPart = decodeBrowsePathPart(pathPart);
if (decodedPathPart === null) {
return null;
}

// @note: decodeURIComponent is needed in case the path contains a space.
switch (pathType) {
case 'tree': {
const rest = tail.startsWith('tree/') ? tail.substring('tree/'.length) : tail.substring('tree'.length);
return {
repoName,
revisionName,
pathType,
path: normalizeRepoPath(decodeURIComponent(rest)),
path: normalizeRepoPath(decodedPathPart),
};
}
case 'commits': {
const rest = tail.startsWith('commits/') ? tail.substring('commits/'.length) : tail.substring('commits'.length);
return {
repoName,
revisionName,
pathType,
path: normalizeRepoPath(decodeURIComponent(rest)),
path: normalizeRepoPath(decodedPathPart),
};
}
case 'commit': {
// Path suffix on /-/commit/<sha>/<path> is no longer used, but we
// keep the slash-split here so legacy URLs still resolve to the
// commit (we just ignore everything after the SHA).
const rest = tail.startsWith('commit/') ? tail.substring('commit/'.length) : tail.substring('commit'.length);
const firstSlash = rest.indexOf('/');
const commitSha = decodeURIComponent(firstSlash === -1 ? rest : rest.substring(0, firstSlash));
const firstSlash = decodedPathPart.indexOf('/');
const commitSha = firstSlash === -1 ? decodedPathPart : decodedPathPart.substring(0, firstSlash);

if (!commitSha) {
throw new Error(`Invalid browse pathname: "${pathParam}" - expected to contain a commit SHA for commit type`);
return null;
}

return {
Expand All @@ -129,11 +132,10 @@ export const getBrowseParamsFromPathParam = (pathParam: string): BrowseProps =>
};
}
case 'blob': {
const rest = tail.startsWith('blob/') ? tail.substring('blob/'.length) : tail.substring('blob'.length);
const path = normalizeRepoPath(decodeURIComponent(rest));
const path = normalizeRepoPath(decodedPathPart);

if (path === '') {
throw new Error(`Invalid browse pathname: "${pathParam}" - expected to contain a path for blob type`);
return null;
}

return {
Expand Down
17 changes: 0 additions & 17 deletions packages/web/src/app/(app)/browse/layout.tsx
View file
Open in desktop

This file was deleted.

Loading
Loading