feat(docs-page/server): catch invalid requests

.changeset/dirty-pears-divide.md

@@ -0,0 +1,5 @@
+---
+'@hashicorp/react-docs-page': minor
+---
+
+catches invalid request and 404s

packages/docs-page/server/__tests__/is-invalid-uri.test.ts

@@ -0,0 +1,14 @@
+import { isInvalidURI } from '../is-invalid-uri'
+
+describe('isInvalidURI', () => {
+  it.each([
+    ['/docs/upgrade', false],
+    ['foo/bar%23anchor', false],
+    [
+      "/docs/upgrade%25'%20AND%202*3*8=6*8%20AND%20'zVVl'!='zVVl%25/upgrade-specific",
+      true,
+    ],
+  ])('given `%s`, returns `%s`', (a, expected) => {
+    expect(isInvalidURI(a)).toBe(expected)
+  })
+})

packages/docs-page/server/index.ts

@@ -3,6 +3,8 @@ import { ContentApiError } from '../content-api'
 import FileSystemLoader from './loaders/file-system'
 import RemoteContentLoader from './loaders/remote-content'
 import { DataLoader } from './loaders/types'
+import { isInvalidURI } from './is-invalid-uri'
+import { DEFAULT_PARAM_ID } from './consts'
 
 // We currently export most utilities individually,
 // since we have cases such as Packer remote plugin docs
@@ -67,6 +69,21 @@ export function getStaticGenerationFunctions(
       }
     },
     getStaticProps: async (ctx) => {
+      const pathParams = ctx.params?.[opts.paramId || DEFAULT_PARAM_ID]
+
+      if (pathParams) {
+        if (Array.isArray(pathParams)) {
+          const path = pathParams.join('/')
+          if (isInvalidURI(path)) {
+            return { notFound: true }
+          }
+        } else if (typeof pathParams === 'string') {
+          if (isInvalidURI(pathParams)) {
+            return { notFound: true }
+          }
+        }
+      }
+
       try {
         const props = await loader.loadStaticProps(ctx)
         return {

packages/docs-page/server/is-invalid-uri.ts

@@ -0,0 +1,12 @@
+/** matches any whitespace or % */
+const RE = /(\s|%)/gi
+/** decodes a URI once, and returns if it is invalid */
+export const isInvalidURI = (uri: string) => {
+  try {
+    const res = decodeURIComponent(uri)
+    return !!res.match(RE)
+  } catch (err: any) {
+    console.warn(err.message, uri)
+    return true
+  }
+}