Skip to content

fix(@angular/build): match proxy glob patterns against URL pathname only - #34377

Open
clydin wants to merge 1 commit into
angular:mainfrom
clydin:fix/proxy-glob-query-string
Open

clydin wants to merge 1 commit into
angular:mainfrom
clydin:fix/proxy-glob-query-string

Conversation

@clydin

@clydin clydin commented Oct 16, 2026

Copy link
Copy Markdown
Member

When normalizing proxy configurations for Vite, glob patterns are converted into regular expression strings using picomatch. Because picomatch builds regular expressions assuming the input is a file path and anchors them with $, whereas Vite tests regex proxy keys against req.url (which includes any query string), requests with query parameters could fail to match glob entries such as /search/** or /api/*.json, or inadvertently match wildcards against query string parameters.

Adapt the generated regular expression so that wildcard tokens do not match across the ? query delimiter and end-of-path anchors allow an optional query string after the matched pathname.

Closes #34257

When normalizing proxy configurations for Vite, glob patterns are converted
into regular expression strings using picomatch. Because picomatch builds
regular expressions assuming the input is a file path and anchors them with
`$`, whereas Vite tests regex proxy keys against `req.url` (which includes
any query string), requests with query parameters could fail to match glob
entries such as `/search/**` or `/api/*.json`, or inadvertently match
wildcards against query string parameters.

Adapt the generated regular expression so that wildcard tokens do not match
across the `?` query delimiter and end-of-path anchors allow an optional
query string after the matched pathname.

Closes angular#34257
@clydin clydin added the target: patch This PR is targeted for the next patch release label Oct 16, 2026
@clydin
clydin marked this pull request as ready for review October 16, 2026 16:33

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the dev-server proxy configuration to ensure that glob patterns are matched against the URL pathname portion of a request rather than matching across query string parameters. It introduces a helper function makeUrlRegExpFromGlob to convert glob patterns into regular expressions that allow optional query strings, and adds comprehensive unit tests to verify this behavior. The review feedback suggests improving the robustness of the regular expression used to match unescaped end-of-input anchors, and adding a fallback to tmpdir() in the unit tests to support running them in local environments where TEST_TMPDIR is not set.

Comment thread packages/angular/build/src/utils/load-proxy-config_spec.ts
Comment thread packages/angular/build/src/utils/load-proxy-config_spec.ts
Comment thread packages/angular/build/src/utils/load-proxy-config.ts
@clydin clydin added the action: review The PR is still awaiting reviews from at least one requested reviewer label Oct 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

action: review The PR is still awaiting reviews from at least one requested reviewer area: @angular/build target: patch This PR is targeted for the next patch release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Vite dev server: proxy config normalization reorders glob keys, drops string context and misses URLs with a query string

1 participant