gatsbyjs/gatsby

Page-data not escaping brackets for splat routes

Open

#37717 opened on Mar 2, 2023

View on GitHub
 (4 comments) (0 reactions) (0 assignees)JavaScript (55,950 stars) (10,198 forks)batch import
help wantedstatus: confirmedtype: bug

Description

Preliminary Checks

Description

When using splatroutes, a file called /page-data/[...foobar]/page-data.json is created and downloaded by Gatsby upon invoking that splatroute.

The problem is that Gatsby is NOT escaping the brackets ([]) in the request fetching it, thus breaking the RFC3986 which prohibits the use of [] in the path (unless encoded as %5B/%5D).

Some webservers allow it, while others disallow it, some have undefined behaviour. Playframework is one of the few that actually asserts that they DON'T work in a test case. https://github.com/playframework/playframework/blob/main/core/play-integration-test/src/it/scala/play/it/http/BadClientHandlingSpec.scala#L58-L65

Reproduction Link

https://github.com/affemaen/gatspy-splat-route

Steps to Reproduce

  1. Clone the repository
  2. npm install
  3. npm run build && npm run serve
  4. Open the page in a browser
  5. Open up browser developer tools and reload the page
  6. Click the network tab in Developer tools
  7. Click Fetch/XHR
  8. Click on page-data.json
  9. Check the Request URL: .../page-data/[...index]/page-data.json

Expected Result

The request url to fetch the page-data.json should be .../page-data/%5B...index%5D/page-data.json

Actual Result

The request url to fetch the page-data.json is actually .../page-data/[...index]/page-data.json

Environment

System:
    OS: macOS 13.1
    CPU: (10) arm64 Apple M1 Max
    Shell: 5.8.1 - /bin/zsh
  Binaries:
    Node: 18.12.1 - /usr/local/bin/node
    npm: 8.19.2 - /usr/local/bin/npm
  Browsers:
    Chrome: 110.0.5481.177
    Firefox: 108.0.2
    Safari: 16.2
  npmPackages:
    gatsby: ^5.7.0 => 5.7.0

Config Flags

No response

Contributor guide