fix: try to serve assets from unencoded and encoded paths

packages/miniflare/src/plugins/assets/index.ts

@@ -239,10 +239,9 @@ const walk = async (dir: string) => {
 				 */
 
 				const [pathHash, contentHash] = await Promise.all([
-					hashPath(encodeFilePath(relativeFilepath, path.sep)),
-					hashPath(
-						encodeFilePath(filepath, path.sep) + filestat.mtimeMs.toString()
-					),
+					hashPath(normalizeFilePath(relativeFilepath)),
+					// used absolute filepath here so that changes to the enclosing asset folder will be registered
+					hashPath(filepath + filestat.mtimeMs.toString()),
 				]);
 				manifest.push({
 					pathHash,

packages/workers-shared/asset-worker/src/handler.ts

@@ -18,11 +18,8 @@ export const handleRequest = async (
 ) => {
 	const { pathname, search } = new URL(request.url);
 
-	const decoded = pathname
-		.split("/")
-		.map((x) => decodeURIComponent(x))
-		.join("/");
-	const intent = await getIntent(decoded, configuration, exists);
+	const decodedPathname = decodePath(pathname);
+	const intent = await getIntent(decodedPathname, configuration, exists);
 
 	if (!intent) {
 		return new NotFoundResponse();
@@ -36,11 +33,14 @@ export const handleRequest = async (
 		return new MethodNotAllowedResponse();
 	}
 
-	const decodedDestination = intent.redirect ?? decoded;
-	const encodedDestination = decodedDestination
-		.split("/")
-		.map((x) => encodeURIComponent(x))
-		.join("/");
+	const decodedDestination = intent.redirect ?? decodedPathname;
+	const encodedDestination = encodePath(decodedDestination);
+
+	/**
+	 * The canonical path we serve an asset at is the decoded and re-encoded version.
+	 * Thus we need to redirect if that is different from the decoded version.
+	 * We combine this with other redirects (e.g. for html_handling) to avoid multiple redirects.
+	 */
 	if (encodedDestination !== pathname || intent.redirect) {
 		return new TemporaryRedirectResponse(encodedDestination + search);
 	}
@@ -370,7 +370,6 @@ const htmlHandlingForceTrailingSlash = async (
 		return {
 			asset: { eTag: exactETag, status: 200 },
 			redirect: null,
-			file: pathname,
 		};
 	} else if (
 		(redirectResult = await safeRedirect(
@@ -653,3 +652,44 @@ const safeRedirect = async (
 
 	return null;
 };
+/**
+ *
+ * +===========================================+===========+======================+
+ * |              character type               |  fetch()  | encodeURIComponent() |
+ * +===========================================+===========+======================+
+ * | unreserved ASCII e.g. a-z                 | unchanged | unchanged            |
+ * +-------------------------------------------+-----------+----------------------+
+ * | reserved (sometimes encoded)			   | unchanged | encoded			  |
+ * | e.g. [ ] @ $ ! ' ( ) * + , ; = : ? # & %  |           |                      |
+ * +-------------------------------------------+-----------+----------------------+
+ * | non-ASCII e.g. ü. and space               | encoded   | encoded              |
+ * +-------------------------------------------+-----------+----------------------+
+ *
+ * 1. Decode incoming path to handle non-ASCII characters or optionally encoded characters (e.g. square brackets)
+ * 2. Match decoded path to manifest
+ * 3. Re-encode the path and redirect if the re-encoded path is different from the original path
+ *
+ * If the user uploads a file that is already URL-encoded, that is accessible only at the (double) encoded path.
+ * e.g. /%5Bboop%5D.html is served at /%255Bboop%255D only
+ *
+ * */
+
+/**
+ * Decode all incoming paths to ensure that we can handle paths with non-ASCII characters.
+ */
+const decodePath = (pathname: string) => {
+	return pathname
+		.split("/")
+		.map((x) => decodeURIComponent(x))
+		.join("/");
+};
+/**
+ * Use the encoded path as the canonical path for sometimes-encoded characters
+ * e.g. /[boop] -> /%5Bboop%5D 307
+ */
+const encodePath = (pathname: string) => {
+	return pathname
+		.split("/")
+		.map((x) => encodeURIComponent(x))
+		.join("/");
+};

packages/workers-shared/utils/helpers.ts

@@ -1,8 +1,12 @@
+import { isAbsolute, sep } from "node:path";
 import { getType } from "mime";
 
-/** normalises sep for windows */
-export const normalizeFilePath = (filePath: string, sep: string) => {
-	const encodedPath = filePath.split(sep).join("/");
+/** normalises sep for windows and prefix with `/` */
+export const normalizeFilePath = (relativeFilepath: string) => {
+	if (!isAbsolute(relativeFilepath)) {
+		throw new Error(`Expected relative path`);
+	}
+	const encodedPath = relativeFilepath.split(sep).join("/");
 	return "/" + encodedPath;
 };
 

packages/workers-shared/utils/tsconfig.json

@@ -4,7 +4,7 @@
 		"lib": ["es2021"],
 		"module": "NodeNext",
 		"moduleResolution": "nodenext",
-		"types": ["@cloudflare/workers-types/experimental"],
+		"types": ["@cloudflare/workers-types/experimental", "@types/node"],
 		"noEmit": true,
 		"isolatedModules": true,
 		"allowSyntheticDefaultImports": true,

packages/wrangler/src/experimental-assets.ts

@@ -263,7 +263,7 @@ export const buildAssetManifest = async (dir: string) => {
 							`Ensure all assets in your assets directory "${dir}" conform with the Workers maximum size requirement.`
 					);
 				}
-				manifest[normalizeFilePath(relativeFilepath, path.sep)] = {
+				manifest[normalizeFilePath(relativeFilepath)] = {
 					hash: hashFile(filepath),
 					size: filestat.size,
 				};