fix(rewrites): preserve external destination path prefixes

Author: james-elicx

examples/pages-router-cloudflare/next.config.mjs

@@ -25,7 +25,12 @@ export default {
 
   async rewrites() {
     return {
-      beforeFiles: [],
+      beforeFiles: [
+        {
+          source: "/external-prefix/:path*",
+          destination: "http://127.0.0.1:4231/v1/:path*",
+        },
+      ],
       afterFiles: [{ source: "/nav-test", destination: "/about" }],
       fallback: [],
     };

packages/vinext/src/config/config-matchers.ts

@@ -1137,7 +1137,11 @@ export function matchesRewriteSource(
  * Handles repeated params (e.g. `/api/:id/:id`) and catch-all suffix forms
  * (`:path*`, `:path+`) in a single pass. Unknown params are left intact.
  */
-function substituteDestinationParams(destination: string, params: Record<string, string>): string {
+function substituteDestinationParams(
+  destination: string,
+  params: Record<string, string>,
+  encodePathParams = false,
+): string {
   const keys = Object.keys(params);
   if (keys.length === 0) return destination;
 
@@ -1157,8 +1161,13 @@ function substituteDestinationParams(destination: string, params: Record<string,
     _compiledDestinationParamCache.set(cacheKey, paramRe);
   }
 
-  const replaceParams = (value: string, encodeParam: (value: string) => string): string =>
-    value.replace(paramRe, (_token, key: string) => encodeParam(params[key]));
+  const replaceParams = (
+    value: string,
+    encodeParam: (value: string, modifier: string | undefined) => string,
+  ): string =>
+    value.replace(paramRe, (_token, key: string, modifier: string | undefined) =>
+      encodeParam(params[key], modifier),
+    );
 
   const hashIndex = destination.indexOf("#");
   const beforeHash = hashIndex === -1 ? destination : destination.slice(0, hashIndex);
@@ -1168,13 +1177,30 @@ function substituteDestinationParams(destination: string, params: Record<string,
   if (queryIndex !== -1) {
     const beforeQuery = beforeHash.slice(0, queryIndex);
     const query = beforeHash.slice(queryIndex + 1);
-    return `${replaceParams(beforeQuery, (value) => value)}?${replaceParams(
+    return `${replaceParams(beforeQuery, encodePathParams ? encodeDestinationPathParamValue : (value) => value)}?${replaceParams(
       query,
-      encodeDestinationQueryParamValue,
+      (value) => encodeDestinationQueryParamValue(value),
     )}${replaceParams(hash, (value) => value)}`;
   }
 
-  return replaceParams(destination, (value) => value);
+  return replaceParams(
+    destination,
+    encodePathParams ? encodeDestinationPathParamValue : (value) => value,
+  );
+}
+
+function encodeDestinationPathParamValue(value: string, modifier: string | undefined): string {
+  if (modifier === "*" || modifier === "+") {
+    return value.split("/").map(encodeDestinationPathSegment).join("/");
+  }
+  return encodeDestinationPathSegment(value);
+}
+
+function encodeDestinationPathSegment(value: string): string {
+  if (/^(?:\.|%2e){1,2}$/i.test(value)) {
+    return value.replace(/\.|%2e/gi, (dot) => (dot === "." ? "%252e" : dot.replace("%", "%25")));
+  }
+  return value;
 }
 
 function encodeDestinationQueryParamValue(value: string): string {
@@ -1207,7 +1233,9 @@ function substituteAndSanitizeRewriteDestination(
   destination: string,
   params: Record<string, string>,
 ): string {
-  const rewritten = substituteAndSanitizeDestination(destination, params);
+  const rewritten = sanitizeDestination(
+    substituteDestinationParams(destination, params, isExternalUrl(destination)),
+  );
   if (!shouldAppendRewriteParamsToQuery(destination, params)) return rewritten;
 
   const existingQueryKeys = getDestinationQueryKeys(destination);

packages/vinext/src/index.ts

@@ -99,7 +99,7 @@ import {
   VINEXT_TIMING_HEADER,
 } from "./server/headers.js";
 import { logRequest, now } from "./server/request-log.js";
-import { normalizePath } from "./server/normalize-path.js";
+import { escapeUrlDotSegments, normalizePath } from "./server/normalize-path.js";
 import {
   filterInternalHeaders,
   INTERNAL_HEADERS,
@@ -4739,7 +4739,7 @@ export const loadServerActionClient = ${
               // receives the decoded path for config rule matching.
               {
                 const qs = url.includes("?") ? url.slice(url.indexOf("?")) : "";
-                url = pathname + qs;
+                url = escapeUrlDotSegments(pathname) + qs;
               }
 
               const capturedMiddlewarePath = middlewarePath;

packages/vinext/src/server/normalize-path.ts

@@ -43,6 +43,15 @@ export function decodePathParams(pathname: string): string {
     .join("/");
 }
 
+export function escapeUrlDotSegments(pathname: string): string {
+  return pathname
+    .split("/")
+    .map((segment) =>
+      /^(?:\.|%2e){1,2}$/i.test(segment) ? segment.replaceAll("%", "%25") : segment,
+    )
+    .join("/");
+}
+
 export function isInterceptionMatchedUrlPath(value: string): boolean {
   return (
     value.startsWith("/") &&

packages/vinext/src/server/prod-server.ts

@@ -34,7 +34,7 @@ import {
   DEFAULT_IMAGE_SIZES,
   type ImageConfig,
 } from "./image-optimization.js";
-import { normalizePath } from "./normalize-path.js";
+import { escapeUrlDotSegments, normalizePath } from "./normalize-path.js";
 import { filterInternalHeaders, isOpenRedirectShaped } from "./request-pipeline.js";
 import { notFoundResponse } from "./http-error-responses.js";
 import {
@@ -1439,7 +1439,7 @@ async function startAppRouterServer(options: AppRouterServerOptions) {
       // RSC handler receives an already-canonical path and doesn't need to
       // re-normalize. This deduplicates the normalizePath work done above.
       const qs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
-      const normalizedUrl = pathname + qs;
+      const normalizedUrl = escapeUrlDotSegments(pathname) + qs;
 
       // Convert Node.js request to Web Request and call the RSC handler
       const request = nodeToWebRequest(req, normalizedUrl, prerenderSecret);
@@ -1660,7 +1660,7 @@ async function startPagesRouterServer(options: PagesRouterServerOptions) {
       res.end("Bad Request");
       return;
     }
-    let url = pathname + rawQs;
+    let url = escapeUrlDotSegments(pathname) + rawQs;
 
     // Internal prerender endpoint — only reachable with the correct build-time secret.
     // Used by the prerender phase to fetch getStaticPaths results via HTTP.

playwright.config.ts

@@ -2,7 +2,7 @@ import { defineConfig } from "@playwright/test";
 
 const appRouterBrowserSpecificTests = "**/app-router/**/*.browser.spec.ts";
 const appRouterServer = {
-  command: "npx vp dev --port 4174",
+  command: "TEST_EXTERNAL_REWRITE_ORIGIN=http://127.0.0.1:4228 npx vp dev --port 4174",
   cwd: "./tests/fixtures/app-basic",
   port: 4174,
   reuseExistingServer: !process.env.CI,
@@ -35,7 +35,8 @@ const projectServers = {
     testDir: "./tests/e2e/pages-router",
     use: { baseURL: "http://localhost:4173" },
     server: {
-      command: "npx vp run vinext#build && npx vp dev --port 4173",
+      command:
+        "TEST_EXTERNAL_REWRITE_ORIGIN=http://127.0.0.1:4229 npx vp run vinext#build && TEST_EXTERNAL_REWRITE_ORIGIN=http://127.0.0.1:4229 npx vp dev --port 4173",
       cwd: "./tests/fixtures/pages-basic",
       port: 4173,
       reuseExistingServer: !process.env.CI,
@@ -119,7 +120,7 @@ const projectServers = {
       // Use node to invoke the CLI directly — npx vinext may not be on PATH
       // in fixture subdirectories since vinext is a workspace dependency.
       command:
-        "npx vp run vinext#build && node ../../../packages/vinext/dist/cli.js build && node ../../../packages/vinext/dist/cli.js start --port 4175",
+        "TEST_EXTERNAL_REWRITE_ORIGIN=http://127.0.0.1:4230 npx vp run vinext#build && TEST_EXTERNAL_REWRITE_ORIGIN=http://127.0.0.1:4230 node ../../../packages/vinext/dist/cli.js build && TEST_EXTERNAL_REWRITE_ORIGIN=http://127.0.0.1:4230 node ../../../packages/vinext/dist/cli.js start --port 4175",
       cwd: "./tests/fixtures/pages-basic",
       port: 4175,
       reuseExistingServer: !process.env.CI,

tests/app-router-production-server.test.ts

@@ -109,6 +109,35 @@ type StartedTextSequenceTarget = {
   url: string;
 };
 
+async function startPathEchoTarget(): Promise<StartedTextSequenceTarget> {
+  const upstream = http.createServer((req, res) => {
+    res.setHeader("content-type", "application/json");
+    res.end(JSON.stringify({ pathname: new URL(req.url ?? "/", "http://localhost").pathname }));
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    upstream.once("error", reject);
+    upstream.listen(0, "127.0.0.1", () => {
+      upstream.off("error", reject);
+      resolve();
+    });
+  });
+
+  const address = upstream.address();
+  if (!address || typeof address === "string") {
+    throw new Error("Path echo target did not bind to a TCP port");
+  }
+
+  return {
+    url: `http://127.0.0.1:${address.port}`,
+    close() {
+      return new Promise<void>((resolve, reject) => {
+        upstream.close((error) => (error ? reject(error) : resolve()));
+      });
+    },
+  };
+}
+
 async function startTextSequenceTarget(options?: {
   prefix?: string;
   recordRequest?: (req: http.IncomingMessage) => void;
@@ -212,6 +241,7 @@ describe("App Router Production server (startProdServer)", () => {
   let appStaticDynamicTarget: StartedTextSequenceTarget | undefined;
   let appStaticRevalidateTarget: StartedTextSequenceTarget | undefined;
   let revalidatePathFetchTarget: StartedTextSequenceTarget | undefined;
+  let externalRewriteTarget: StartedTextSequenceTarget | undefined;
 
   function extractRequestId(html: string): string | undefined {
     return (
@@ -257,6 +287,7 @@ describe("App Router Production server (startProdServer)", () => {
   }
 
   beforeAll(async () => {
+    externalRewriteTarget = await startPathEchoTarget();
     appStaticDelayTarget = await startDelayedJsonSequenceTarget(750);
     appStaticDynamicTarget = await startTextSequenceTarget({ prefix: "dynamic" });
     appStaticRevalidateTarget = await startTextSequenceTarget({ prefix: "revalidate" });
@@ -265,6 +296,7 @@ describe("App Router Production server (startProdServer)", () => {
     process.env.TEST_APP_STATIC_DYNAMIC_TARGET = appStaticDynamicTarget.url;
     process.env.TEST_APP_STATIC_REVALIDATE_TARGET = appStaticRevalidateTarget.url;
     process.env.TEST_REVALIDATE_PATH_REWRITES_TARGET = revalidatePathFetchTarget.url;
+    process.env.TEST_EXTERNAL_REWRITE_ORIGIN = externalRewriteTarget.url;
 
     try {
       // Build the app-basic fixture to the default dist/ directory
@@ -289,15 +321,18 @@ describe("App Router Production server (startProdServer)", () => {
         await appStaticDynamicTarget?.close();
         await appStaticRevalidateTarget?.close();
         await revalidatePathFetchTarget?.close();
+        await externalRewriteTarget?.close();
       } finally {
         appStaticDelayTarget = undefined;
         appStaticDynamicTarget = undefined;
         appStaticRevalidateTarget = undefined;
         revalidatePathFetchTarget = undefined;
+        externalRewriteTarget = undefined;
         delete process.env.TEST_APP_STATIC_DELAY_TARGET;
         delete process.env.TEST_APP_STATIC_DYNAMIC_TARGET;
         delete process.env.TEST_APP_STATIC_REVALIDATE_TARGET;
         delete process.env.TEST_REVALIDATE_PATH_REWRITES_TARGET;
+        delete process.env.TEST_EXTERNAL_REWRITE_ORIGIN;
       }
       throw error;
     }
@@ -309,10 +344,12 @@ describe("App Router Production server (startProdServer)", () => {
     await appStaticDynamicTarget?.close();
     await appStaticRevalidateTarget?.close();
     await revalidatePathFetchTarget?.close();
+    await externalRewriteTarget?.close();
     delete process.env.TEST_APP_STATIC_DELAY_TARGET;
     delete process.env.TEST_APP_STATIC_DYNAMIC_TARGET;
     delete process.env.TEST_APP_STATIC_REVALIDATE_TARGET;
     delete process.env.TEST_REVALIDATE_PATH_REWRITES_TARGET;
+    delete process.env.TEST_EXTERNAL_REWRITE_ORIGIN;
     fs.rmSync(outDir, { recursive: true, force: true });
   });
 
@@ -325,6 +362,16 @@ describe("App Router Production server (startProdServer)", () => {
     expect(html).toContain("<script");
   });
 
+  it("preserves external rewrite path prefixes", async () => {
+    for (const pathname of ["%252e%252e", ".%252e", "%252e."]) {
+      const response = await fetch(`${baseUrl}/external-prefix/${pathname}/outside`);
+      expect(response.status).toBe(200);
+      expect(await response.json()).toEqual({
+        pathname: expect.stringMatching(/^\/v1(?:\/|$)/),
+      });
+    }
+  });
+
   // Ported from Next.js: test/e2e/app-dir/app-static/app-static.test.ts
   // https://github.com/vercel/next.js/blob/v16.2.6/test/e2e/app-dir/app-static/app-static.test.ts
   it("contains dynamic = 'error' failures without terminating later App Router requests", async () => {

tests/e2e/app-router/route-config.spec.ts

@@ -1,7 +1,32 @@
+import { createServer, type Server } from "node:http";
 import { test, expect } from "@playwright/test";
 
 const BASE = "http://localhost:4174";
 
+let externalRewriteServer: Server;
+
+test.beforeAll(async () => {
+  externalRewriteServer = createServer((request, response) => {
+    response.writeHead(200, { "content-type": "application/json" });
+    response.end(
+      JSON.stringify({
+        pathname: new URL(request.url ?? "/", "http://127.0.0.1:4228").pathname,
+      }),
+    );
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    externalRewriteServer.once("error", reject);
+    externalRewriteServer.listen(4228, "127.0.0.1", resolve);
+  });
+});
+
+test.afterAll(async () => {
+  await new Promise<void>((resolve, reject) => {
+    externalRewriteServer.close((error) => (error ? reject(error) : resolve()));
+  });
+});
+
 test.describe("Route segment configs", () => {
   test("force-static page renders", async ({ page }) => {
     const response = await page.goto(`${BASE}/static-test`);
@@ -23,4 +48,22 @@ test.describe("Route segment configs", () => {
     await expect(page.locator("h1")).toHaveText("ISR Revalidate Page");
     await expect(page.locator('[data-testid="timestamp"]')).not.toBeEmpty();
   });
+
+  test("external catch-all rewrites preserve their destination path prefix", async ({
+    request,
+  }) => {
+    const normal = await request.get(`${BASE}/external-prefix/resource`);
+    expect(normal.status()).toBe(200);
+    await expect(normal.json()).resolves.toEqual({ pathname: "/v1/resource" });
+
+    for (const pathname of ["%252e%252e", ".%252e", "%252e."]) {
+      const traversal = await request.get(`${BASE}/external-prefix/${pathname}/outside`);
+      expect(traversal.status()).toBe(200);
+      const traversalResult = (await traversal.json()) as { pathname: string };
+      expect(traversalResult.pathname).toMatch(/^\/v1(?:\/|$)/);
+    }
+
+    const confusedPrefix = await request.get(`${BASE}/external-prefix../outside`);
+    expect(confusedPrefix.status()).toBe(404);
+  });
 });

tests/e2e/cloudflare-pages-router/external-rewrite.spec.ts

@@ -0,0 +1,40 @@
+import { createServer, type Server } from "node:http";
+import { expect, test } from "@playwright/test";
+
+let externalRewriteServer: Server;
+
+test.beforeAll(async () => {
+  externalRewriteServer = createServer((request, response) => {
+    response.writeHead(200, { "content-type": "application/json" });
+    response.end(
+      JSON.stringify({
+        pathname: new URL(request.url ?? "/", "http://127.0.0.1:4231").pathname,
+      }),
+    );
+  });
+  await new Promise<void>((resolve, reject) => {
+    externalRewriteServer.once("error", reject);
+    externalRewriteServer.listen(4231, "127.0.0.1", resolve);
+  });
+});
+
+test.afterAll(async () => {
+  await new Promise<void>((resolve, reject) => {
+    externalRewriteServer.close((error) => (error ? reject(error) : resolve()));
+  });
+});
+
+test("external catch-all rewrites preserve their destination path prefix", async ({ request }) => {
+  const normal = await request.get("/external-prefix/resource");
+  expect(normal.status()).toBe(200);
+  await expect(normal.json()).resolves.toEqual({ pathname: "/v1/resource" });
+
+  for (const pathname of ["%252e%252e", ".%252e", "%252e."]) {
+    const traversal = await request.get(`/external-prefix/${pathname}/outside`);
+    expect(traversal.status()).toBe(200);
+    const traversalResult = (await traversal.json()) as { pathname: string };
+    expect(traversalResult.pathname).toMatch(/^\/v1(?:\/|$)/);
+  }
+
+  expect((await request.get("/external-prefix../outside")).status()).toBe(404);
+});