Skip to content

feat: protect URL path integrity from unsafe interpolated values #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maxholman merged 3 commits into from
Mar 17, 2026
Merged

feat: protect URL path integrity from unsafe interpolated values #12

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
73b3141
fix: camelCase hono-valibot middleware export names
maxholman Mar 17, 2026
0d966b2
feat: protect URL path integrity from unsafe interpolated values
maxholman Mar 17, 2026
6a5bc29
chore: regenerate fixtures
maxholman Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
feat: protect URL path integrity from unsafe interpolated values 
Path parameters containing `/`, `#`, or other reserved characters would
corrupt the URL structure. A tagged template literal now applies
encodeURIComponent to all interpolated path segments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
  • Loading branch information
@maxholman @claude
maxholman and claude committed Mar 17, 2026
commit 0d966b2cfae272e629b5d5880d79337b1cb2fa9f
31 changes: 28 additions & 3 deletions lib/process-document.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,30 @@ export async function processOpenApiDocument(
moduleSpecifier: "@block65/rest-client",
});

commandsFile.addFunction({
name: "encodePath",
docs: [
{
description: wordWrap(
"Tagged template literal that applies encodeURIComponent to all interpolated values, protecting path integrity from characters like `/` and `#`.",
),
tags: [
{
tagName: "example",
text: 'encodePath`/users/${userId}` // "/users/foo%2Fbar"',
},
],
},
],
parameters: [
{ name: "strings", type: "TemplateStringsArray" },
{ name: "...values", type: "string[]" },
],
returnType: "string",
statements:
"return String.raw({ raw: strings }, ...values.map(encodeURIComponent));",
});

commandsFile.addImportDeclaration({
namedImports: ["Jsonifiable"],
moduleSpecifier: "type-fest",
Expand Down Expand Up @@ -786,9 +810,10 @@ export async function processOpenApiDocument(
?.addTypeArgument(queryType.getName());
}

const pathname = `\`${path
// .replaceAll(/\{(\w+)\}/g, camelcase)
.replaceAll(/{/g, "${")}\``;
const hasPathParams = path.includes("{");
const pathname = hasPathParams
? `encodePath\`${path.replaceAll(/{/g, "${")}\``
: `"${path}"`;

const hasJsonBody = !!jsonBodyType;

Expand Down