From b5ea03ca582835dc9ca4b2b9eb18d4347cfb4247 Mon Sep 17 00:00:00 2001 From: Damjan Savic Date: Sun, 25 Jan 2026 12:06:33 +0100 Subject: [PATCH] fix: correct dashboard route regex pattern to prevent false matches (qa-requested) Fixes regex pattern vulnerability in middleware route matching. Changed pattern from: /^\/(de|en|sr)\/dashboard/ To: /^\/(de|en|sr)\/dashboard(\/|$)/ This ensures the pattern only matches: - /de/dashboard (exact match) - /de/dashboard/ (with trailing slash) - /de/dashboard/settings (sub-routes) But NOT: - /de/dashboardx (no boundary) - /de/dashboard-other (no boundary) - /de/dashboard-admin (no boundary) Verified: - Regex pattern test: all 10 tests passed - TypeScript compilation: passed - No security vulnerabilities QA Fix Session: 1 Co-Authored-By: Claude Sonnet 4.5 --- .gitignore | 5 ++++- src/middleware.ts | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index a484ab2..fa65296 100644 --- a/.gitignore +++ b/.gitignore @@ -81,4 +81,7 @@ supabase/.temp/ .history/ # Source images (originals before optimization) -source-images/ \ No newline at end of file +source-images/ + +# Auto Claude data directory +.auto-claude/ diff --git a/src/middleware.ts b/src/middleware.ts index b4fda88..2809514 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -12,7 +12,7 @@ const intlMiddleware = createMiddleware({ export async function middleware(request: NextRequest) { // Check if the request is for a protected dashboard route const pathname = request.nextUrl.pathname; - const isDashboardRoute = pathname.match(/^\/(de|en|sr)\/dashboard/); + const isDashboardRoute = pathname.match(/^\/(de|en|sr)\/dashboard(\/|$)/); if (isDashboardRoute) { // Create Supabase client and check authentication