fix: preserve query string when stripping path prefix (#249)

Author: panva

lib/engine.js

@@ -65,6 +65,8 @@ function middie (complete, options = {}) {
     holder.res = res
     holder.normalizedUrl = normalizePathForMatching(sanitizeUrl(req.url), normalizationOptions)
     holder.normalizedReqUrl = normalizePathForMatching(req.url, normalizationOptions)
+    const sanitized = sanitizeUrl(req.url)
+    holder.urlSuffix = req.url.slice(sanitized.length)
     holder.context = ctx
     holder.done()
   }
@@ -75,6 +77,7 @@ function middie (complete, options = {}) {
     this.res = null
     this.normalizedUrl = null
     this.normalizedReqUrl = null
+    this.urlSuffix = null
     this.context = null
     this.i = 0
 
@@ -84,6 +87,7 @@ function middie (complete, options = {}) {
       const res = that.res
       const normalizedUrl = that.normalizedUrl
       const normalizedReqUrl = that.normalizedReqUrl
+      const urlSuffix = that.urlSuffix
       const context = that.context
       const i = that.i++
 
@@ -94,6 +98,7 @@ function middie (complete, options = {}) {
         that.res = null
         that.normalizedUrl = null
         that.normalizedReqUrl = null
+        that.urlSuffix = null
         that.context = null
         that.i = 0
         pool.release(that)
@@ -106,6 +111,7 @@ function middie (complete, options = {}) {
         that.res = null
         that.normalizedUrl = null
         that.normalizedReqUrl = null
+        that.urlSuffix = null
         that.context = null
         that.i = 0
         pool.release(that)
@@ -120,6 +126,7 @@ function middie (complete, options = {}) {
             if (req.url[0] !== '/') {
               req.url = '/' + req.url
             }
+            req.url = req.url + urlSuffix
             fn(req, res, that.done)
           } else {
             that.done()

test/req-url-stripping.test.js

@@ -143,3 +143,60 @@ test('req.url stripping with all normalization options combined', async (t) => {
   await app.inject({ method: 'GET', url: '//secret//data//' })
   t.assert.strictEqual(capturedUrl, '/data', '//secret//data// should strip to /data')
 })
+
+test('req.url stripping preserves query string', async (t) => {
+  const app = Fastify()
+  t.after(() => app.close())
+
+  await app.register(middiePlugin)
+
+  let capturedUrl = null
+
+  app.use('/api', (req, _res, next) => {
+    capturedUrl = req.url
+    next()
+  })
+
+  app.get('/api/resource', async () => ({ ok: true }))
+
+  capturedUrl = null
+  await app.inject({ method: 'GET', url: '/api/resource?foo=bar' })
+  t.assert.strictEqual(capturedUrl, '/resource?foo=bar', 'single query param preserved')
+
+  capturedUrl = null
+  await app.inject({ method: 'GET', url: '/api/resource?foo=bar&baz=qux' })
+  t.assert.strictEqual(capturedUrl, '/resource?foo=bar&baz=qux', 'multiple query params preserved')
+
+  capturedUrl = null
+  await app.inject({ method: 'GET', url: '/api/resource?a=1&b=2&c=3' })
+  t.assert.strictEqual(capturedUrl, '/resource?a=1&b=2&c=3', 'many query params preserved')
+})
+
+test('req.url stripping preserves query string with normalization options', async (t) => {
+  const app = Fastify({
+    routerOptions: {
+      ignoreDuplicateSlashes: true,
+      ignoreTrailingSlash: true
+    }
+  })
+  t.after(() => app.close())
+
+  await app.register(middiePlugin)
+
+  let capturedUrl = null
+
+  app.use('/secret', (req, _res, next) => {
+    capturedUrl = req.url
+    next()
+  })
+
+  app.get('/secret/data', async () => ({ ok: true }))
+
+  capturedUrl = null
+  await app.inject({ method: 'GET', url: '//secret/data?key=value' })
+  t.assert.strictEqual(capturedUrl, '/data?key=value', '//secret/data?key=value preserves query string')
+
+  capturedUrl = null
+  await app.inject({ method: 'GET', url: '/secret//data/?key=value' })
+  t.assert.strictEqual(capturedUrl, '/data?key=value', '/secret//data/?key=value preserves query string')
+})