fix(tests): improve ReDoS protection in NavigationProvider tests and update string interpolation

Author: Noggling

packages/modules/navigation/src/__tests__/NavigationProvider.test.ts

@@ -1,3 +1,5 @@
+/* biome-ignore lint/suspicious/noExplicitAny: Allow usage of 'any' in test files for mocking purposes */
+
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 import { NavigationProvider } from '../NavigationProvider';
 import { MemoryHistory } from '../lib/MemoryHistory';
@@ -99,7 +101,7 @@ describe('NavigationProvider', () => {
     it('should handle pathological input efficiently (ReDoS protection)', () => {
       // Create a string with many consecutive slashes to test performance
       // This would cause ReDoS with certain regex patterns
-      const manySlashes = '/apps' + '/'.repeat(10000) + 'my-app';
+      const manySlashes = `/apps/${'/'.repeat(10000)}my-app`;
 
       const startTime = Date.now();
       const provider = new NavigationProvider({
@@ -117,7 +119,7 @@ describe('NavigationProvider', () => {
     it('should handle pathological trailing slashes efficiently (ReDoS protection)', () => {
       // Create a string with many trailing slashes
       // The /\/+$/ regex pattern would cause ReDoS with this input
-      const manyTrailingSlashes = '/apps/my-app' + '/'.repeat(10000);
+      const manyTrailingSlashes = `/apps/my-app${'/'.repeat(10000)}`;
 
       const startTime = Date.now();
       const provider = new NavigationProvider({

packages/plugins/context-navigation/src/apply-navigation.ts

@@ -11,7 +11,7 @@ import type {
   ContextNavigationSkippedDetail,
 } from './types';
 import type { ContextNavigationEventSource } from './create-context-navigation-plugin';
-import { normalizePath } from './helpers';
+import { normalizePathFromURL } from './helpers';
 
 /**
  * Set of normalized paths that the plugin itself has navigated to.
@@ -118,7 +118,7 @@ export async function applyNavigation(
   // Step 2: Compare normalized paths to avoid redundant navigations.
   // This prevents a replace() call when the URL is already correct, which
   // would otherwise create a spurious history entry in some browsers.
-  if (normalizePath(targetURL) === normalizePath(currentURL)) {
+  if (normalizePathFromURL(targetURL) === normalizePathFromURL(currentURL)) {
     event.dispatchEvent('onContextNavigationSkipped', {
       detail: { appKey, reason: 'url-matches' } as ContextNavigationSkippedDetail,
       source: eventSource,
@@ -156,7 +156,7 @@ export async function applyNavigation(
 
       // Step 4: Record the token BEFORE navigating so the guard sees it
       // on the resulting state$ emission and skips re-processing.
-      ownNavTokens.add(normalizePath(targetURL));
+      ownNavTokens.add(normalizePathFromURL(targetURL));
       navigation.navigate(targetURL, navOptionsOverride ?? config.navigationOptions);
 
       // Post-navigation bookkeeping: notify listeners and invoke callback.

packages/plugins/context-navigation/src/guard-handlers/consume-own-nav-token.ts

@@ -1,4 +1,4 @@
-import { normalizePath } from '../helpers';
+import { normalizePathFromURL } from '../helpers';
 import type { OwnNavigationTokens } from '../apply-navigation';
 
 /**
@@ -20,7 +20,7 @@ import type { OwnNavigationTokens } from '../apply-navigation';
  * @returns `true` if this navigation was plugin-initiated (caller should bail).
  */
 export function consumeOwnNavToken(currentURL: URL, ownNavTokens: OwnNavigationTokens): boolean {
-  const normalized = normalizePath(currentURL);
+  const normalized = normalizePathFromURL(currentURL);
 
   // Token present — this navigation was plugin-initiated; consume it and signal the caller to bail.
   if (ownNavTokens.has(normalized)) {

packages/plugins/context-navigation/src/helpers/index.ts

@@ -1,3 +1,4 @@
+export { normalizePathFromURL } from './normalize-path-from-url';
 export { normalizePath } from './normalize-path';
 export { getCurrentURL } from './get-current-url';
 export { resolveAdapter } from './resolve-adapter';

packages/plugins/context-navigation/src/helpers/normalize-path-from-url.ts

@@ -0,0 +1,13 @@
+import { normalizePath } from './normalize-path';
+/**
+ * Normalize a URL to its path + search representation for comparison.
+ *
+ * Strips trailing slashes from the pathname so that `/apps/foo/` and
+ * `/apps/foo` compare as equal.
+ *
+ * @param url - The URL to normalize.
+ * @returns A string of the form `pathname + search` with trailing slash removed.
+ */
+export function normalizePathFromURL(url: URL): string {
+  return `${normalizePath(url.pathname)}${url.search}`;
+}

packages/plugins/context-navigation/src/helpers/normalize-path.ts

@@ -1,12 +1,33 @@
 /**
- * Normalize a URL to its path + search representation for comparison.
+ * Normalizes a path string to ensure it is in a consistent format for comparison and processing.
  *
- * Strips trailing slashes from the pathname so that `/apps/foo/` and
- * `/apps/foo` compare as equal.
+ * This function performs the following normalizations:
+ * - Ensures the path starts with a leading slash.
+ * - Removes any trailing slashes, except for the root path ("/").
+ * - Converts empty paths to the root path ("/").
+ * - Fixing multiple consecutive slashes to a single slash.
  *
- * @param url - The URL to normalize.
- * @returns A string of the form `pathname + search` with trailing slash removed.
+ * @param path - The path string to normalize.
+ * @returns The normalized path string.
  */
-export function normalizePath(url: URL): string {
-  return `${url.pathname.replace(/\/$/, '') || '/'}${url.search}`;
+export function normalizePath(path: string): string {
+  // Replace multiple consecutive slashes with a single slash
+  path = path.replace(/\/+/g, '/');
+
+  // Ensure the path starts with a leading slash
+  if (!path.startsWith('/')) {
+    path = `/${path}`;
+  }
+
+  // Remove trailing slashes, except for the root path
+  if (path.length > 1 && path.endsWith('/')) {
+    path = path.slice(0, -1);
+  }
+
+  // Convert empty paths to the root path
+  if (path === '') {
+    return '/';
+  }
+
+  return path;
 }

packages/plugins/context-navigation/src/reconcile.ts

@@ -8,7 +8,7 @@ import type {
 } from './types';
 import type { ContextNavigationEventSource } from './create-context-navigation-plugin';
 import type { ReconcilerSourceEntry } from './sources/types';
-import { getCurrentURL, normalizePath, resolveAdapter, stripQueryParams } from './helpers';
+import { getCurrentURL, normalizePathFromURL, resolveAdapter, stripQueryParams } from './helpers';
 import { applyNavigation, type ApplyNavigationDeps } from './apply-navigation';
 
 /** Dependencies required by {@link reconcile}. */
@@ -74,8 +74,8 @@ export function reconcile(
     const targetURL = new URL(targetPath, config.origin);
 
     // Only navigate if the target path differs from current path
-    if (normalizePath(targetURL) !== normalizePath(currentURL)) {
-      ownNavTokens.add(normalizePath(targetURL));
+    if (normalizePathFromURL(targetURL) !== normalizePathFromURL(currentURL)) {
+      ownNavTokens.add(normalizePathFromURL(targetURL));
       navigation.navigate(targetURL, config.navigationOptions);
       log(`Null context → navigated to [${targetPath}] for [${appKey}]`);
     }

packages/plugins/context-navigation/src/utils/url/build-app-route.ts

@@ -8,7 +8,7 @@
  * @returns The constructed app route path string.
  */
 export const buildAppRoute = (appKey: string, contextId?: string, rest?: string): string => {
-  let path = [`/apps/${appKey}`];
+  const path = [`/apps/${appKey}`];
 
   // Context segment is optional — omitted when no context is actively selected
   if (contextId) path.push(`${contextId}`);

packages/plugins/context-navigation/src/utils/url/build-context-url-for-strategy.ts

@@ -43,7 +43,7 @@ export const buildContextUrlForStrategy = (
   // Path is not a recognised app route — return it unchanged
   if (!match) {
     return path;
-  } 
-  
+  }
+
   return buildAppRoute(match.appKey, contextId ?? undefined);
 };

packages/plugins/context-navigation/src/utils/url/parse-app-route.ts

@@ -1,3 +1,4 @@
+import { normalizePath } from '../../helpers';
 /**
  * URLPattern for the standard Fusion portal app route:
  *
@@ -37,9 +38,9 @@ export const parseAppRoute = (pathname: string): AppRouteMatch | undefined => {
     pathname = `/${pathname}`;
   }
 
-  const normalized = pathname.replace(/\/+$/, '') || '/';
+  const normalized = normalizePath(pathname);
   const result = APP_ROUTE_PATTERN.exec({ pathname: normalized });
-  
+
   // Pathname does not match the /apps/:appKey pattern
   if (!result) {
     return undefined;