Normalize double slashes in resolvePath

Author: brophdawg11

.changeset/forty-tips-admire.md

@@ -0,0 +1,5 @@
+---
+"@remix-run/router": patch
+---
+
+Normalize double-slashes in `resolvePath`

packages/react-router/__tests__/resolvePath-test.tsx

@@ -1,10 +1,38 @@
 import { resolvePath } from "react-router";
 
 describe("resolvePath", () => {
+  it("does not touch with protocol-less absolute paths", () => {
+    expect(resolvePath("//google.com")).toMatchObject({
+      pathname: "//google.com",
+    });
+
+    expect(resolvePath("//google.com/../../path")).toMatchObject({
+      pathname: "//google.com/../../path",
+    });
+
+    expect(resolvePath("//google.com?q=query#hash")).toMatchObject({
+      pathname: "//google.com",
+      search: "?q=query",
+      hash: "#hash",
+    });
+  });
+
   it('resolves absolute paths irrespective of the "from" pathname', () => {
     expect(resolvePath("/search", "/inbox")).toMatchObject({
       pathname: "/search",
     });
+
+    expect(resolvePath("/search/../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+
+    expect(resolvePath("/search/../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+
+    expect(resolvePath("/search/user/../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
   });
 
   it("resolves relative paths", () => {
@@ -23,6 +51,32 @@ describe("resolvePath", () => {
     expect(resolvePath("search", "/inbox")).toMatchObject({
       pathname: "/inbox/search",
     });
+
+    expect(resolvePath("search/../123", "/inbox")).toMatchObject({
+      pathname: "/inbox/123",
+    });
+
+    expect(resolvePath("search/../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+
+    expect(resolvePath("search/../../../123", "/inbox")).toMatchObject({
+      pathname: "/123",
+    });
+  });
+
+  it("normalizes any mid-path double-slashes", () => {
+    let spy = jest.spyOn(console, "warn").mockImplementation(() => {});
+
+    expect(resolvePath("/search/../..//foo")).toMatchObject({
+      pathname: "/foo",
+    });
+
+    expect(resolvePath("search/../..//foo", "/inbox")).toMatchObject({
+      pathname: "/foo",
+    });
+
+    spy.mockRestore();
   });
 
   it('ignores trailing slashes on the "from" pathname when resolving relative paths', () => {

packages/router/utils.ts

@@ -1128,6 +1128,9 @@ export function stripBasename(
   return pathname.slice(startIndex) || "/";
 }
 
+const ABSOLUTE_URL_REGEX = /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i;
+export const isAbsoluteUrl = (url: string) => ABSOLUTE_URL_REGEX.test(url);
+
 /**
  * Returns a resolved path object relative to the given pathname.
  *
@@ -1140,11 +1143,29 @@ export function resolvePath(to: To, fromPathname = "/"): Path {
     hash = "",
   } = typeof to === "string" ? parsePath(to) : to;
 
-  let pathname = toPathname
-    ? toPathname.startsWith("/")
-      ? toPathname
-      : resolvePathname(toPathname, fromPathname)
-    : fromPathname;
+  let pathname: string;
+  if (toPathname) {
+    if (isAbsoluteUrl(toPathname)) {
+      pathname = toPathname;
+    } else {
+      if (toPathname.includes("//")) {
+        let oldPathname = toPathname;
+        toPathname = toPathname.replace(/\/\/+/g, "/");
+        warning(
+          false,
+          `Pathnames cannot have embedded double slashes - normalizing ` +
+            `${oldPathname} -> ${toPathname}`
+        );
+      }
+      if (toPathname.startsWith("/")) {
+        pathname = resolvePathname(toPathname.substring(1), "/");
+      } else {
+        pathname = resolvePathname(toPathname, fromPathname);
+      }
+    }
+  } else {
+    pathname = fromPathname;
+  }
 
   return {
     pathname,