fix: dont allow urls with double slashes in pathname

opengovsg · Jan 14, 2025 · 2251a6a · 2251a6a
1 parent 9d6f03b
commit 2251a6a
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/packages/validators/src/url/schema.ts b/packages/validators/src/url/schema.ts
@@ -48,6 +48,11 @@ export const toSchema = (options: ParsedUrlValidatorOptions) => {
           }
         }
 
+        // don't allow pathname with double slashes
+        if (url.pathname.replace(/\\/g, '/').startsWith('//')) {
+          return false
+        }
+
         // don't allow dynamic routes
         if (isDynamicRoute(url)) {
           return false