You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The tests of #12858 send requests with fetch(), which normalizes URLs like browsers do: it resolves . and .. segments (%2E%2E included) and drops the #hash. Hand-typed requests can send these URLs as-is, and Node passes them untouched to the docusaurus serve request handler.
A new asIs test option sends the first request with http.get(), which keeps the path as-is. Redirects are still followed with fetch(), like a browser does. New snapshot tables capture how these URLs are served under a baseUrl. Several of them land on the homepage, because the serve-handler redirects drop the baseUrl:
Two rows capture open redirect attempts like /base/..//example.com/index, which main doesn't redirect to another host. The tests never follow redirects to other hosts, so a regression can't make them send network requests.
This captures the behavior before #12879 and #12877, which parse the request URL with the WHATWG URL parser, so their diffs show how these URLs change.
Test Plan
pnpm test packages/docusaurus/src/commands/serve. The Windows CI checks the Windows snapshot, where file URLs with a trailing slash serve the file instead of a 404, like in the existing Windows snapshot.
…assisted)
fetch() normalizes request URLs like browsers do, so the tests could not send
a #hash or a ".." segment. Hand-typed requests can, and the serve request
handler sees them as-is. A new test option sends the first request with
http.get() to capture this behavior.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No actionable comments were generated in the recent review.
Walkthrough
The serve test utilities can send initial request paths without browser-style URL normalization. New request-handler tests record redirect and response outcomes for hand-typed paths across trailingSlash settings.
Changes: Serve request-path tests
Layer / File(s)
Summary
Send initial paths as supplied packages/docusaurus/src/commands/serve/__tests__/testUtils.ts
The test helpers accept an optional asIs setting and use a raw HTTP request for the initial path when enabled. Redirects use fetch and are followed only when their resolved origin matches the test server.
Record fragment and dot-segment responses packages/docusaurus/src/commands/serve/__tests__/requestHandler.test.ts
Tests cover fragments, dot segments, traversal attempts, and redirect-shaped paths under multiple trailingSlash settings. The trailingSlash: true cases include separate Windows and non-Windows expectations.
meta/docusaurus#12858: Adds the serve request test utility and fixture that this change extends.
meta/docusaurus#12865: Exposes the request handler that the test utility uses to exercise hand-typed paths.
meta/docusaurus#12879: Changes clean-URL redirects and updates hand-typed URL snapshots whose outcomes this change records.
Merge Risk: Minimal · up to 38877
The changes add raw-path request coverage without an established behavior regression. No actionable merge-blocking risk remains.
Pre-merge checks: 5
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title describes the added tests for hand-typed URLs in docusaurus serve.
Docstring Coverage
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 2 files.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.
…ted)
Hand-typed URLs whose ".." segments resolve to "//example.com" must not
redirect to another host. The tests also never follow redirects to other
hosts, so a regression can't make them send network requests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CLA SignedSigned Facebook CLApr: maintenanceThis PR does not produce any behavior differences to end users when upgrading.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The tests of #12858 send requests with
fetch(), which normalizes URLs like browsers do: it resolves.and..segments (%2E%2Eincluded) and drops the#hash. Hand-typed requests can send these URLs as-is, and Node passes them untouched to thedocusaurus serverequest handler.A new
asIstest option sends the first request withhttp.get(), which keeps the path as-is. Redirects are still followed withfetch(), like a browser does. New snapshot tables capture how these URLs are served under abaseUrl. Several of them land on the homepage, because the serve-handler redirects drop thebaseUrl:/base/file.html#hash→301 /file→ homepagetrailingSlash: true,/base/file.html#hash→302 /base/file.html/#hash→ 404 (Windows servesfile.html)Two rows capture open redirect attempts like
/base/..//example.com/index, whichmaindoesn't redirect to another host. The tests never follow redirects to other hosts, so a regression can't make them send network requests.This captures the behavior before #12879 and #12877, which parse the request URL with the WHATWG URL parser, so their diffs show how these URLs change.
Test Plan
pnpm test packages/docusaurus/src/commands/serve. The Windows CI checks the Windows snapshot, where file URLs with a trailing slash serve the file instead of a 404, like in the existing Windows snapshot.Test links
Deploy preview: https://deploy-preview-12881--docusaurus-2.netlify.app/
Related issues/PRs
docusaurus serveclean URL redirects keep the baseUrl (AI-assisted) #12879 and fix(core):docusaurus serveno longer adds a trailing slash to some assets under a baseUrl (AI-assisted) #12877(AI-assisted)
🤖 Generated with Claude Code
Summary by CodeRabbit