Normalize double-slashes in resolvePath (#14529)

Author: brophdawg11

.changeset/nice-goats-shout.md

@@ -0,0 +1,5 @@
+---
+"react-router": patch
+---
+
+Normalize double-slashes in `resolvePath`

packages/react-router/__tests__/resolvePath-test.tsx

@@ -1,10 +1,38 @@
 import { resolvePath } from "react-router";
 
 describe("resolvePath", () => {
+  it("does not touch with protocol-less absolute paths", () => {
+    expect(resolvePath("//google.com")).toMatchObject({
+      pathname: "//google.com",
+    });
+
+    expect(resolvePath("//google.com/../../path")).toMatchObject({
+      pathname: "//google.com/../../path",
+    });
+
+    expect(resolvePath("//google.com?q=query#hash")).toMatchObject({
+      pathname: "//google.com",
+      search: "?q=query",
+      hash: "#hash",
+    });
+  });
+
   it('resolves absolute paths irrespective of the "from" pathname', () => {
     expect(resolvePath("/search", "/inbox")).toMatchObject({
       pathname: "/search",
     });
+
+    expect(resolvePath("/search/../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+
+    expect(resolvePath("/search/../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+
+    expect(resolvePath("/search/user/../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
   });
 
   it("resolves relative paths", () => {
@@ -23,6 +51,32 @@ describe("resolvePath", () => {
     expect(resolvePath("search", "/inbox")).toMatchObject({
       pathname: "/inbox/search",
     });
+
+    expect(resolvePath("search/../123", "/inbox")).toMatchObject({
+      pathname: "/inbox/123",
+    });
+
+    expect(resolvePath("search/../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+
+    expect(resolvePath("search/../../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+  });
+
+  it("normalizes any mid-path double-slashes", () => {
+    let spy = jest.spyOn(console, "warn").mockImplementation(() => {});
+
+    expect(resolvePath("/search/../..//foo")).toMatchObject({
+      pathname: "/foo",
+    });
+
+    expect(resolvePath("search/../..//foo", "/inbox")).toMatchObject({
+      pathname: "/foo",
+    });
+
+    spy.mockRestore();
   });
 
   it('ignores trailing slashes on the "from" pathname when resolving relative paths', () => {

packages/react-router/lib/router/router.ts

@@ -58,6 +58,7 @@ import {
   convertRoutesToDataRoutes,
   getPathContributingMatches,
   getResolveToMatches,
+  isAbsoluteUrl,
   isUnsupportedLazyRouteObjectKey,
   isUnsupportedLazyRouteFunctionKey,
   isRouteErrorResponse,
@@ -838,9 +839,6 @@ export const IDLE_BLOCKER: BlockerUnblocked = {
   location: undefined,
 };
 
-const ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
-export const isAbsoluteUrl = (url: string) => ABSOLUTE_URL_REGEX.test(url);
-
 const defaultMapRouteProperties: MapRoutePropertiesFunction = (route) => ({
   hasErrorBoundary: Boolean(route.hasErrorBoundary),
 });

packages/react-router/lib/router/utils.ts

@@ -1571,6 +1571,9 @@ export function prependBasename({
   return pathname === "/" ? basename : joinPaths([basename, pathname]);
 }
 
+const ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
+export const isAbsoluteUrl = (url: string) => ABSOLUTE_URL_REGEX.test(url);
+
 /**
  * Returns a resolved {@link Path} object relative to the given pathname.
  *
@@ -1588,11 +1591,29 @@ export function resolvePath(to: To, fromPathname = "/"): Path {
     hash = "",
   } = typeof to === "string" ? parsePath(to) : to;
 
-  let pathname = toPathname
-    ? toPathname.startsWith("/")
-      ? toPathname
-      : resolvePathname(toPathname, fromPathname)
-    : fromPathname;
+  let pathname: string;
+  if (toPathname) {
+    if (isAbsoluteUrl(toPathname)) {
+      pathname = toPathname;
+    } else {
+      if (toPathname.includes("//")) {
+        let oldPathname = toPathname;
+        toPathname = toPathname.replace(/\/\/+/g, "/");
+        warning(
+          false,
+          `Pathnames cannot have embedded double slashes - normalizing ` +
+            `${oldPathname} -> ${toPathname}`,
+        );
+      }
+      if (toPathname.startsWith("/")) {
+        pathname = resolvePathname(toPathname.substring(1), "/");
+      } else {
+        pathname = resolvePathname(toPathname, fromPathname);
+      }
+    }
+  } else {
+    pathname = fromPathname;
+  }
 
   return {
     pathname,

packages/react-router/lib/rsc/server.rsc.ts

@@ -12,7 +12,6 @@ import type {
 import { type Location } from "../router/history";
 import {
   createStaticHandler,
-  isAbsoluteUrl,
   isMutationMethod,
   isResponse,
   isRedirectResponse,
@@ -26,6 +25,7 @@ import {
   type ShouldRevalidateFunction,
   type RouterContextProvider,
   type TrackedPromise,
+  isAbsoluteUrl,
   isRouteErrorResponse,
   matchRoutes,
   prependBasename,