validateAndDecodePathname() — astro Function Reference

Architecture documentation for the validateAndDecodePathname() function in pathname.ts from the astro codebase.

Function typescript CoreAstro RenderingEngine

Entity Profile

CoreAstro→ RenderingEngine→ validateAndDecodePathname() — astro Function Reference

Dependency Diagram

graph TD
  e732ef89_ce9c_5bce_1ff3_fa1275ad887d["validateAndDecodePathname()"]
  2047bef3_0d82_1e33_7548_bbb8b5b4d111["pathname.ts"]
  e732ef89_ce9c_5bce_1ff3_fa1275ad887d -->|defined in| 2047bef3_0d82_1e33_7548_bbb8b5b4d111
  style e732ef89_ce9c_5bce_1ff3_fa1275ad887d fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

packages/astro/src/core/util/pathname.ts lines 10–31

export function validateAndDecodePathname(pathname: string): string {
	let decoded: string;

	try {
		decoded = decodeURI(pathname);
	} catch (_e) {
		throw new Error('Invalid URL encoding');
	}

	// Check if the decoded path is different from the original
	// AND still contains URL-encoded sequences.
	// This indicates the original had encoding that got partially decoded, suggesting double encoding.
	// Example: /%2561dmin -> decodeURI -> /%61dmin (different AND still has %)
	const hasDecoding = decoded !== pathname;
	const decodedStillHasEncoding = /%[0-9a-fA-F]{2}/.test(decoded);

	if (hasDecoding && decodedStillHasEncoding) {
		throw new Error('Multi-level URL encoding is not allowed');
	}

	return decoded;
}