handle repeated slash scanner posts

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>

Author: cursoragent

epicshop/patch-workshop-app.js

@@ -12,6 +12,15 @@ const defaultServerBuildPath = path.join(
 	'server',
 	'index.js',
 )
+const defaultServerRuntimePath = path.join(
+	here,
+	'node_modules',
+	'@epic-web',
+	'workshop-app',
+	'dist',
+	'server',
+	'index.js',
+)
 
 const notFoundActionFunctionName = 'action$splatNotFound'
 const notFoundActionFunction = `async function ${notFoundActionFunctionName}() {
@@ -50,6 +59,21 @@ const routeManifestNeedle =
 const patchedRouteManifestNeedle =
 	'"routes/$": { "id": "routes/$", "parentId": "root", "path": "*", "index": void 0, "caseSensitive": void 0, "hasAction": true,'
 
+const repeatedSlashMiddleware = `app.use((req, res, next) => {
+  const requestPath = req.originalUrl.split("?")[0];
+  if (req.method !== "GET" && req.method !== "HEAD" && req.method !== "OPTIONS" && /^\\/{2,}$/.test(requestPath)) {
+    res.status(404).send("Not found");
+    return;
+  }
+  next();
+});
+`
+
+const requestContextMiddlewareNeedle =
+	'app.use((_req, _res, next) => requestContext.run({}, next));\n'
+
+const patchedRequestContextMiddlewareNeedle = `${requestContextMiddlewareNeedle}${repeatedSlashMiddleware}`
+
 export function patchWorkshopAppServerBuild(source) {
 	const hasActionFunction = source.includes(
 		`async function ${notFoundActionFunctionName}()`,
@@ -111,20 +135,57 @@ export function patchWorkshopAppServerBuild(source) {
 	}
 }
 
+export function patchWorkshopAppServerRuntime(source) {
+	if (source.includes(repeatedSlashMiddleware)) {
+		return { patched: false, source }
+	}
+
+	if (!source.includes(requestContextMiddlewareNeedle)) {
+		throw new Error(
+			'Could not find the workshop-app request context middleware to patch.',
+		)
+	}
+
+	return {
+		patched: true,
+		source: source.replace(
+			requestContextMiddlewareNeedle,
+			patchedRequestContextMiddlewareNeedle,
+		),
+	}
+}
+
 export async function patchWorkshopApp({
 	serverBuildPath = defaultServerBuildPath,
+	serverRuntimePath = defaultServerRuntimePath,
 } = {}) {
-	const source = await fs.readFile(serverBuildPath, 'utf8')
-	const result = patchWorkshopAppServerBuild(source)
-
-	if (result.patched) {
-		await fs.writeFile(serverBuildPath, result.source)
+	const [serverBuildSource, serverRuntimeSource] = await Promise.all([
+		fs.readFile(serverBuildPath, 'utf8'),
+		fs.readFile(serverRuntimePath, 'utf8'),
+	])
+	const serverBuildResult = patchWorkshopAppServerBuild(serverBuildSource)
+	const serverRuntimeResult = patchWorkshopAppServerRuntime(serverRuntimeSource)
+
+	await Promise.all([
+		serverBuildResult.patched
+			? fs.writeFile(serverBuildPath, serverBuildResult.source)
+			: null,
+		serverRuntimeResult.patched
+			? fs.writeFile(serverRuntimePath, serverRuntimeResult.source)
+			: null,
+	])
+
+	if (serverBuildResult.patched || serverRuntimeResult.patched) {
 		console.log(
 			'Patched @epic-web/workshop-app splat route to return a normal 404 for POST scanner traffic.',
 		)
 	}
 
-	return result
+	return {
+		patched: serverBuildResult.patched || serverRuntimeResult.patched,
+		serverBuild: serverBuildResult,
+		serverRuntime: serverRuntimeResult,
+	}
 }
 
 if (import.meta.url === pathToFileURL(process.argv[1]).href) {

epicshop/patch-workshop-app.test.js

@@ -3,6 +3,7 @@ import test from 'node:test'
 import {
 	patchWorkshopApp,
 	patchWorkshopAppServerBuild,
+	patchWorkshopAppServerRuntime,
 } from './patch-workshop-app.js'
 
 const unpatchedServerBuildFixture = `async function loader$L({
@@ -38,6 +39,13 @@ const route1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProper
 const serverManifest = { "routes": { "routes/$": { "id": "routes/$", "parentId": "root", "path": "*", "index": void 0, "caseSensitive": void 0, "hasAction": false, "hasLoader": true } } };
 `
 
+const unpatchedServerRuntimeFixture = `app.use((_req, _res, next) => requestContext.run({}, next));
+app.options("*splat", (_req, res) => {
+  res.set("Allow", "GET, HEAD, POST, OPTIONS");
+  res.sendStatus(204);
+});
+`
+
 test('adds a 404 action to the workshop-app splat route module', () => {
 	const result = patchWorkshopAppServerBuild(unpatchedServerBuildFixture)
 
@@ -62,10 +70,27 @@ test('fails loudly when the expected route shape changes', () => {
 	)
 })
 
+test('adds a narrow repeated-slash POST guard before React Router', () => {
+	const result = patchWorkshopAppServerRuntime(unpatchedServerRuntimeFixture)
+
+	assert.equal(result.patched, true)
+	assert.match(result.source, /requestPath = req\.originalUrl\.split/)
+	assert.match(result.source, /\^\\\/\{2,\}\$/)
+})
+
+test('does not modify an already patched server runtime', () => {
+	const firstResult = patchWorkshopAppServerRuntime(unpatchedServerRuntimeFixture)
+	const secondResult = patchWorkshopAppServerRuntime(firstResult.source)
+
+	assert.equal(secondResult.patched, false)
+	assert.equal(secondResult.source, firstResult.source)
+})
+
 test('patches the installed workshop-app build', async () => {
 	const result = await patchWorkshopApp()
 
 	assert.equal(typeof result.patched, 'boolean')
-	assert.match(result.source, /action: action\$splatNotFound/)
-	assert.match(result.source, /"routes\/\$": .*"hasAction": true/)
+	assert.match(result.serverBuild.source, /action: action\$splatNotFound/)
+	assert.match(result.serverBuild.source, /"routes\/\$": .*"hasAction": true/)
+	assert.match(result.serverRuntime.source, /\^\\\/\{2,\}\$/)
 })