漏洞概述 该漏洞涉及对URL编码的过度处理，可能导致安全绕过或拒绝服务攻击。具体表现为在URL路径解码过程中，如果编码次数过多，可能会导致路径被错误地解析，从而绕过中间件的安全检查。 影响范围 影响组件： 、 、 、 、 影响版本：Astro 6.4.8 及之前版本 修复方案 1. 限制解码次数：在 中，增加了 常量，限制URL路径解码的最大次数为10次。 2. 错误处理：在 和 中，增加了对 的处理，当检测到URL路径被过度编码时，返回400错误状态码。 3. 中间件检查：在 中，增加了对 的检查，如果检测到无效解码，直接返回400错误，避免后续中间件的处理。 4. 测试用例：增加了 测试用例，验证修复后的行为是否符合预期。 POC代码 ```typescript // double-encoding-bypass.test.ts describe('URL normalization: double-encoding middleware bypass', () => { it('blocks /api/admin even when middleware calls next(context.url)', async () => { const app = createApp(createRewriteAuthMiddleware()); const response = await app.render(new Request('http://example.com/api/admin')); assert.equal(response.status, 401, '/api/admin must be blocked by middleware'); }); it('blocks double-encoded /api/%2561dmin with a rewriting middleware', async () => { // This decodes to /api/admin, so middleware must see /api/admin and // block it, even though the request is then sent back through routing. const app = createApp(createRewriteAuthMiddleware()); const response = await app.render(new Request('http://example.com/api/%2561dmin')); assert.equal(response.status, 401, 'double-encoded /api/admin must be blocked even with a rewriting middleware'); }); it('rejects an over-encoded path with 400 instead of bypassing to /api/admin', async () => { // Encoded more times than we decode const app = createApp(createRewriteAuthMiddleware()); const response = await app.render(new Request('http://example.com/api/%25252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525252525