fix: prevent use with multi-slash path from matching all routes

lib/layer.js

@@ -241,7 +241,15 @@ function loosen (path) {
     return path
   }
 
-  return Array.isArray(path)
-    ? path.map(function (p) { return loosen(p) })
-    : String(path).replace(TRAILING_SLASH_REGEXP, '')
+  if (Array.isArray(path)) {
+    return path.map(function (p) { return loosen(p) })
+  }
+
+  const str = String(path)
+  const loose = str.replace(TRAILING_SLASH_REGEXP, '')
+
+  // Preserve paths that consist entirely of slashes (e.g. '//')
+  // to prevent them from being reduced to an empty string,
+  // which would incorrectly match all paths.
+  return loose || str
 }

test/router.js

@@ -948,6 +948,72 @@ describe('Router', function () {
       ], done)
     })
 
+    it('should not mount at single "/" when path is "//"', function (done) {
+      const router = new Router()
+      const server = createServer(router)
+
+      router.use('//', saw)
+      router.use(helloWorld)
+
+      series([
+        function (cb) {
+          request(server)
+            .get('/')
+            .expect(200, 'hello, world', cb)
+        },
+        function (cb) {
+          request(server)
+            .get('/foo')
+            .expect(200, 'hello, world', cb)
+        }
+      ], done)
+    })
+
+    it('should not mount at single "/" when path is "///"', function (done) {
+      const router = new Router()
+      const server = createServer(router)
+
+      router.use('///', saw)
+      router.use(helloWorld)
+
+      series([
+        function (cb) {
+          request(server)
+            .get('/')
+            .expect(200, 'hello, world', cb)
+        },
+        function (cb) {
+          request(server)
+            .get('/foo')
+            .expect(200, 'hello, world', cb)
+        }
+      ], done)
+    })
+
+    it('should not expose sub-router routes when mounted at "//"', function (done) {
+      const inner = new Router()
+      const router = new Router()
+      const server = createServer(router)
+
+      inner.get('/', helloWorld)
+      inner.get('/admin', saw)
+
+      router.use('//', inner)
+
+      series([
+        function (cb) {
+          request(server)
+            .get('/')
+            .expect(404, cb)
+        },
+        function (cb) {
+          request(server)
+            .get('/admin')
+            .expect(404, cb)
+        }
+      ], done)
+    })
+
     it('should support array of paths', function (done) {
       const router = new Router()
       const server = createServer(router)