Astro server break when user input invalid url + BXSS attack

[harrytran998]

What version of astro are you using?

latest

Are you using an SSR adapter? If so, which one?

Node Standalone

What package manager are you using?

yarn 3

What operating system are you using?

Mac

What browser are you using?

All

Describe the Bug

When the user enters something wrong url --> Astro server is down immediately.

Something path like this asdasdasd@ax_zX=.zxczas🐥%/úadasd000%/

Your team can go any project with Astro + Stackblitz + add the route params like that in URL --> Bum, down.

The error occur in createServer function.

function createServer({ client, port, host, removeBase }, handler) {
  const listener = (req, res) => {
    if (req.url) {
      let pathname = removeBase(req.url);
      pathname = pathname[0] === "/" ? pathname : "/" + pathname;
      pathname = new URL(pathname, `http://${host}:${port}`).pathname;
	  ///////// BUG HERE ❌❌❌
	  --> encodeURI(decodeURI(pathname)) failed -> Should add a try catch --> or something like forward to 404 page
	  -----
      const stream = send(req, encodeURI(decodeURI(pathname)), {
        root: fileURLToPath(client),
        dotfiles: pathname.startsWith("/.well-known/") ? "allow" : "deny"
      });

Hope your team can fix this 🥹

Link to Minimal Reproducible Example

https://stackblitz.com/github/withastro/astro/tree/latest/examples/basics?file=README.md&on=stackblitz

Participation

• I am willing to submit a pull request for this issue.

[jamesli2021]

At the same time, could worth checking that url should not exceed 2048 characters and supported locale url.

[harrytran998]

Yup, we should have a hook or a function to validate the URL.

[harrytran998]

Today, our website is still down because we have a lot of attacks with BSXX. Hope your team can fix it. If hacker notice, a lot of Astro users will effect!

[Princesseuh]

Hmm, I can't seems to reproduce.

• In dev, there's an error in the terminal, sure, but the server does not go down.
• In SSR, I just get a 404 and the server does not crash.

Do you have a better reproduction you could share?

[Princesseuh]

Ah nevermind, just I sent my message I was able to reproduce 🤦‍♀️ Seems like you can't trigger it from a browser necessarily, needed to use curl

[harrytran998]

Thanks for the quick response. I was making a quick around to patch the @astroj/node. But hope you can do this officially.

Bxss attack include in path name like this: /\\xfs.bxss.me%3Fastrojs.com/hello-world