[core.http] Cleanup catch-all route for paths with trailing slashes. (e…

…lastic#96889) (elastic#97669)
kertal · Apr 20, 2021 · fa06191 · fa06191
1 parent 2f3139c
commit fa06191
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/src/core/server/core_app/core_app.ts b/src/core/server/core_app/core_app.ts
@@ -65,7 +65,7 @@ export class CoreApp {
       async (context, req, res) => {
         const { query, params } = req;
         const { path } = params;
-        if (!path || !path.endsWith('/')) {
+        if (!path || !path.endsWith('/') || path.startsWith('/')) {
           return res.notFound();
         }
 

diff --git a/src/core/server/core_app/integration_tests/core_app_routes.test.ts b/src/core/server/core_app/integration_tests/core_app_routes.test.ts
@@ -39,6 +39,10 @@ describe('Core app routes', () => {
       expect(response.get('location')).toEqual('/base-path/some-path?foo=bar');
     });
 
+    it('does not redirect if the path starts with `//`', async () => {
+      await kbnTestServer.request.get(root, '//some-path/').expect(404);
+    });
+
     it('does not redirect if the path does not end with `/`', async () => {
       await kbnTestServer.request.get(root, '/some-path').expect(404);
     });