Skip to content

fix(locs): guard against non-array locsPath param#165

Open
ArmaanjeetSandhu wants to merge 1 commit into
pajecawav:masterfrom
ArmaanjeetSandhu:fix/validate-locspath-param
Open

fix(locs): guard against non-array locsPath param#165
ArmaanjeetSandhu wants to merge 1 commit into
pajecawav:masterfrom
ArmaanjeetSandhu:fix/validate-locspath-param

Conversation

@ArmaanjeetSandhu

Copy link
Copy Markdown

A malformed locsPath query param can crash the LOC section with an unhandled render exception.

LocsSection parses locsPath like this:

let path: string[] = [];
try {
  const locsPath = router.search.get("locsPath");
  if (locsPath) path = JSON.parse(locsPath);
} catch {
  /* empty */
}

The try/catch only guards against invalid JSON. Valid JSON that isn't a string[] slips through and path ends up non-iterable, so [repo, ...path] (breadcrumbs) and for (const dir of path) (in useLocs) throw TypeError: path is not iterable.

Repro

Open any repo page and append one of these params:

URL param Before After
?locsPath=42 💥 crash root view
?locsPath=null 💥 crash root view
?locsPath={} 💥 crash root view
?locsPath="hi" breadcrumbs become h / i root view
?locsPath=["src"] works works

Since locsPath is shareable in the URL, a hand-edited or stale link is enough to trigger it.

Fix

Extract a parseLocsPath helper that returns the value only when it's an array of strings, and falls back to [] otherwise. No behavior change for well-formed paths.

Testing

  • Verified the helper returns [] for 42, null, true, {}, {"a":1}, "hello", [1,2], foo, null, and "", and passes ["src","lib"] through unchanged.
  • Manually confirmed the page renders the repo root instead of crashing for each bad param above.

@vercel

vercel Bot commented Jul 3, 2026

Copy link
Copy Markdown

@ArmaanjeetSandhu is attempting to deploy a commit to the pajecawav's projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant