Normalize URL handling

end2end/tests-new/react2shell-next.test.mjs

@@ -13,11 +13,11 @@ const port = await getRandomPort();
 const port2 = await getRandomPort();
 
 before(() => {
-  const { stderr } = spawnSync(`npm`, ["run", "build"], {
+  const { status, stderr } = spawnSync(`npm`, ["run", "build"], {
     cwd: pathToAppDir,
   });
 
-  if (stderr && stderr.toString().length > 0) {
+  if (status !== 0) {
     throw new Error(`Failed to build: ${stderr.toString()}`);
   }
 });

library/agent/Context.ts

@@ -8,7 +8,8 @@ import { Source, SOURCES } from "./Source";
 export type User = { id: string; name?: string };
 
 export type Context = {
-  url: string | undefined;
+  url: string | undefined; // Full URL including protocol and host, if available
+  urlPath?: string | undefined; // The path part of the URL (e.g. /api/user)
   method: string | undefined;
   query: ParsedQs;
   headers: Record<string, string | string[] | undefined>;
@@ -81,6 +82,7 @@ export function runWithContext<T>(context: Context, fn: () => T) {
   // In this way we don't lose the `attackDetected` flag
   if (current) {
     current.url = context.url;
+    current.urlPath = context.urlPath;
     current.method = context.method;
     current.query = context.query;
     current.headers = context.headers;

library/agent/Source.ts

@@ -9,6 +9,7 @@ export const SOURCES = [
   "subdomains",
   "markUnsafe",
   "url",
+  "urlPath",
   "rawBody",
 ] as const;
 

library/helpers/getRawRequestPath.test.ts

@@ -0,0 +1,49 @@
+import * as t from "tap";
+import { getRawRequestPath } from "./getRawRequestPath";
+
+t.test("it returns the raw URL path", async (t) => {
+  t.equal(getRawRequestPath(""), "/");
+  t.equal(getRawRequestPath("/"), "/");
+  t.equal(getRawRequestPath("/?test=abc"), "/");
+  t.equal(getRawRequestPath("#"), "/");
+  t.equal(getRawRequestPath("https://example.com"), "/");
+
+  t.equal(
+    getRawRequestPath("https://example.com/path/to/resource"),
+    "/path/to/resource"
+  );
+  t.equal(
+    getRawRequestPath("http://example.com/path/to/resource/"),
+    "/path/to/resource/"
+  );
+  t.equal(
+    getRawRequestPath("https://example.com/path/to/resource/123"),
+    "/path/to/resource/123"
+  );
+  t.equal(
+    getRawRequestPath("https://example.com/path/to/resource/123/456"),
+    "/path/to/resource/123/456"
+  );
+  t.equal(
+    getRawRequestPath("https://example.com/path/to/resource/123/456/789"),
+    "/path/to/resource/123/456/789"
+  );
+  t.equal(
+    getRawRequestPath(
+      "https://example.com/path/to/resource/123/456/789?query=string"
+    ),
+    "/path/to/resource/123/456/789"
+  );
+  t.equal(
+    getRawRequestPath(
+      "https://example.com/path/to/resource/123/456/789#fragment"
+    ),
+    "/path/to/resource/123/456/789"
+  );
+  t.equal(
+    getRawRequestPath(
+      "https://example.com/path/to/resource/123/456/789?query=string#fragment"
+    ),
+    "/path/to/resource/123/456/789"
+  );
+});

library/helpers/getRawRequestPath.ts

@@ -0,0 +1,22 @@
+export function getRawRequestPath(url: string): string {
+  let partialUrl = url;
+
+  // Remove protocol (http://, https://, etc.)
+  const pathStart = partialUrl.indexOf("://");
+  if (pathStart !== -1) partialUrl = partialUrl.slice(pathStart + 3);
+
+  // Remove hostname and port
+  const slashIndex = partialUrl.indexOf("/");
+  if (slashIndex === -1) return "/"; // only hostname given
+  partialUrl = partialUrl.slice(slashIndex);
+
+  // Remove query and fragment
+  const queryIndex = partialUrl.indexOf("?");
+  const hashIndex = partialUrl.indexOf("#");
+
+  let endIndex = partialUrl.length;
+  if (queryIndex !== -1) endIndex = Math.min(endIndex, queryIndex);
+  if (hashIndex !== -1) endIndex = Math.min(endIndex, hashIndex);
+
+  return partialUrl.slice(0, endIndex) || "/";
+}