fix: refuse an empty or dot path id so a request cannot land on a sibling route - #25
Merged
Conversation
…ling route Every path-building read percent-encoded its id, but encodeURIComponent leaves dots alone, so an id of "." or ".." survived into the path and the URL parser inside fetch collapsed it onto the route above, and an empty id turned a single-row route into its list. The caller then read rows it never asked for instead of seeing a failure. Those values are never an id, a name, or an account, so the path builder now throws before the request, naming the field.
robrigo
force-pushed
the
fix/path-segment-guard
branch
from
August 17, 2026 22:48
7235447 to
ac207e9
Compare
There was a problem hiding this comment.
Pull request overview
This PR hardens AtomicMarketApi Explorer URL construction by rejecting path-segment values that can be normalized by the URL parser ('', ., ..), preventing requests from silently landing on sibling/list routes and returning unintended data.
Changes:
- Introduces a centralized
encodeSegmenthelper that throws on empty and dot-segment values (and on missing values) before a network request is made. - Updates all Explorer methods that embed caller-supplied values into URL path segments to use
encodeSegmentinstead ofencodeURIComponent. - Adds targeted tests ensuring invalid segment values do not reach the fetch stub and that dotted Antelope names remain unchanged.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
src/API/Explorer/index.ts |
Adds encodeSegment and applies it to all path-segment-building Explorer methods to prevent dot-segment path rewriting. |
test/path-segments.test.ts |
Adds regression tests covering empty/dot/dot-dot/missing values and a sweep across all affected path-building methods. |
README.md |
Documents the 2.4.1 bug fix behavior change in the changelog section. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
robrigo
marked this pull request as ready for review
August 17, 2026 22:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every path-building read percent-encodes its ids, but
encodeURIComponentleaves dots alone, so an id of.or..survives into the path and the URL parser inside fetch collapses it onto the route above; an empty id turns a single-row route into its list. The caller reads rows it never asked for instead of seeing a failure. None of those values is ever an id, a name, or an account, so the path builder now throws before the request, naming the field, and a missing value is refused the same way. Dotted Antelope names such asalien.worldsandmycoll.wampass unchanged. Every other value keeps the existing percent-encoding.Validation
yarn check-types,yarn lint, andyarn testpass. The new tests drive'',.,..,null, andundefinedthrough a representative reader and assert the fetch stub records no call, sweep every path-building method with.., and pin that a dotted name still reaches the recorded URL unchanged.