Skip to content

fix: match URL-encoded newlines in rest route params #14102

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Aug 6, 2025

Conversation

Conduitry
Copy link
Member

@Conduitry Conduitry commented Aug 4, 2025

Rest route params currently cannot match newline characters (or %0A, a URL-encoded newline character). This is because in regexes, . does not match a newline.

This PR adjusts the regexes created for rest route params to use [^] instead. It adjusts existing unit tests and adds a couple more. Note that we use actual newline characters in the unit tests (rather than %0A) because by the time the exec() function is called in real applications, the URL has already been decoded.


Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

  • It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
  • This message body should clearly illustrate what problems it solves.
  • Ideally, include a test that fails without this PR but passes with it.

Tests

  • Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

  • If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

  • Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

Copy link

changeset-bot bot commented Aug 4, 2025

🦋 Changeset detected

Latest commit: 45980eb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@sveltejs/kit Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@Rich-Harris Rich-Harris merged commit c345382 into sveltejs:main Aug 6, 2025
18 checks passed
@github-actions github-actions bot mentioned this pull request Aug 5, 2025
@Conduitry Conduitry deleted the rest-param-match-newline branch August 6, 2025 00:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants