diff --git a/src/server.ts b/src/server.ts index 7710088d..5a18d49d 100644 --- a/src/server.ts +++ b/src/server.ts @@ -43,6 +43,18 @@ export function getServer( // Express middleware + // Return 400 for URls containing non UTF-8 encoded chars + app.use((req, res, next) => { + const pathOnly = req.url.split('?')[0].split('#')[0]; + try { + decodeURIComponent(pathOnly); + } catch { + res.status(400).send('Bad Request: Invalid URL encoding'); + return; + } + next(); +}); + // Set request-specific values in the very first middleware. app.use('/{*splat}', (req, res, next) => { setLatestRes(res); diff --git a/test/integration/http.ts b/test/integration/http.ts index ec78d4f9..b1087e3d 100644 --- a/test/integration/http.ts +++ b/test/integration/http.ts @@ -100,6 +100,14 @@ describe('HTTP Function', () => { expectedStatus: 404, expectedCallCount: 0, }, + { + name: 'GET with non UTF-8 encoded chars', + httpVerb: 'GET', + path: '/%C3', + expectedBody: {}, + expectedStatus: 400, + expectedCallCount: 0, + }, ]; testData.forEach(test => {