Initial commit

node_modules/astro/dist/core/util/pathname.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Validates that a pathname is not multi-level encoded.
+ * Detects if a pathname contains encoding that was encoded again (e.g., %2561dmin where %25 decodes to %).
+ * This prevents double/triple encoding bypasses of security checks.
+ *
+ * @param pathname - The pathname to validate
+ * @returns The decoded pathname if valid
+ * @throws Error if multi-level encoding is detected
+ */
+export declare function validateAndDecodePathname(pathname: string): string;

node_modules/astro/dist/core/util/pathname.js

@@ -0,0 +1,17 @@
+function validateAndDecodePathname(pathname) {
+  let decoded;
+  try {
+    decoded = decodeURI(pathname);
+  } catch (_e) {
+    throw new Error("Invalid URL encoding");
+  }
+  const hasDecoding = decoded !== pathname;
+  const decodedStillHasEncoding = /%[0-9a-fA-F]{2}/.test(decoded);
+  if (hasDecoding && decodedStillHasEncoding) {
+    throw new Error("Multi-level URL encoding is not allowed");
+  }
+  return decoded;
+}
+export {
+  validateAndDecodePathname
+};