src/runtime/internal/route-rules.ts (1)

29-37: 🛠️ Refactor suggestion | 🟠 Major

Normalize targetPath after the strip-base branch.

targetPath already starts from the raw request path, so keeping the collapse inside if (strpBase) can still miss cases where the matched wildcard rule has an empty strip base. Applying collapseLeadingSlashes() immediately before joinURL() for both branches closes that edge case and simplifies the flow.

♻️ Suggested adjustment

     if (target.endsWith("/**")) {
       let targetPath = event.url.pathname + event.url.search;
       const strpBase = (m.options as any)._redirectStripBase;
       if (strpBase) {
         if (!isPathInScope(event.url.pathname, strpBase)) {
           throw new HTTPError({ status: 400 });
         }
-        targetPath = collapseLeadingSlashes(withoutBase(targetPath, strpBase));
+        targetPath = withoutBase(targetPath, strpBase);
       }
+      targetPath = collapseLeadingSlashes(targetPath);
       target = joinURL(target.slice(0, -3), targetPath);
     }

     if (target.endsWith("/**")) {
       let targetPath = event.url.pathname + event.url.search;
       const strpBase = (m.options as any)._proxyStripBase;
       if (strpBase) {
         if (!isPathInScope(event.url.pathname, strpBase)) {
           throw new HTTPError({ status: 400 });
         }
-        targetPath = collapseLeadingSlashes(withoutBase(targetPath, strpBase));
+        targetPath = withoutBase(targetPath, strpBase);
       }
+      targetPath = collapseLeadingSlashes(targetPath);
       target = joinURL(target.slice(0, -3), targetPath);
     }

Also applies to: 52-60

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/runtime/internal/route-rules.ts` around lines 29 - 37, The code currently
only calls collapseLeadingSlashes(targetPath) inside the strpBase branch which
misses cases when strip-base is empty; always normalize targetPath before
joining. After computing targetPath (and after optionally setting it via
withoutBase when strpBase is truthy and validating with isPathInScope), call
collapseLeadingSlashes(targetPath) unconditionally immediately before the
joinURL call that constructs target (the same change should also be applied to
the similar block that ranges around the later 52-60 lines). Ensure you
reference and update uses of targetPath, strpBase, withoutBase,
collapseLeadingSlashes, isPathInScope, and joinURL so the normalized path is
always passed to joinURL.

src/runtime/internal/route-rules.ts (1)

31-38: ⚠️ Potential issue | 🔴 Critical

Protocol-relative bypass still possible when strip-base is enabled

Line 36 and Line 61 only normalize // in the else branch. If strpBase is set and withoutBase(...) yields a targetPath starting with //, normalization is skipped, so redirect/proxy can still receive protocol-relative style paths.

Suggested fix

       if (strpBase) {
         if (!isPathInScope(event.url.pathname, strpBase)) {
           throw new HTTPError({ status: 400 });
         }
         targetPath = withoutBase(targetPath, strpBase);
-      } else if (targetPath.startsWith("//")) {
+      }
+      if (targetPath.startsWith("//")) {
         targetPath = targetPath.replace(/^\/+/, "/");
       }

       if (strpBase) {
         if (!isPathInScope(event.url.pathname, strpBase)) {
           throw new HTTPError({ status: 400 });
         }
         targetPath = withoutBase(targetPath, strpBase);
-      } else if (targetPath.startsWith("//")) {
+      }
+      if (targetPath.startsWith("//")) {
         targetPath = targetPath.replace(/^\/+/, "/");
       }

Also applies to: 56-63

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/runtime/internal/route-rules.ts` around lines 31 - 38, When strip-base
(strpBase) is set, targetPath returned by withoutBase(event...) may still begin
with "//" and currently only the else branch normalizes leading slashes, leaving
a protocol-relative bypass; update the logic around strpBase, isPathInScope,
withoutBase and the subsequent targetPath handling so that leading-slash
normalization (targetPath.replace(/^\/+/, "/")) is always applied regardless of
whether the strpBase branch ran (i.e., move or duplicate the normalization so
both the strpBase path and the non-strpBase branch normalize targetPath), and
apply the same change to the second similar block that handles targetPath (the
block using the same startsWith("//") check).