fix: allow usage of # and @ in request path

kyma-project · Oct 16, 2024 · d42ff1a · d42ff1a
1 parent 6684520
commit d42ff1a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/backend/request-filters.js b/backend/request-filters.js
@@ -54,8 +54,7 @@ export const pathInvalidCharacterFilter = req => {
     throw Error('Path contains invalid characters.');
   }
 
-  // Allow alphanumeric, dashes, underscores, dots, slashes, colons, tildes, question marks, equals, and ampersands
-  const validPathRegex = /^[a-zA-Z0-9/_\-.:~?&=]+$/;
+  const validPathRegex = /^[a-zA-Z0-9/_\-.:~?&=#@]+$/;
   if (decodedPath.includes('..') || !validPathRegex.test(decodedPath)) {
     throw Error(`Path contains invalid characters.`);
   }

diff --git a/backend/request-filters.test.js b/backend/request-filters.test.js
@@ -111,7 +111,7 @@ describe('pathInvalidCharacterFilter tests', () => {
     {
       description: 'should not throw an error for a valid path',
       req: {
-        originalUrl: '/valid/path-123',
+        originalUrl: '/valid/path-123@456#789',
       },
     },
     {