Tighten image endpoint path handling by matthewp · Pull Request #16544 · withastro/astro

matthewp · 2026-04-30T18:46:59Z

Changes

isRemotePath() now uses a positive allowlist (/^\/[a-zA-Z0-9._@-]/) for the Unix absolute path early-return instead of a negative check against / and \. Control characters like CR, LF, and tab after a leading slash no longer short-circuit as "local".
The dev image endpoint origin check in loadLocalImage now return undefined instead of setting a variable and falling through to loadRemoteImage.

Testing

Added 8 cases to the remotePaths array in packages/internal-helpers/test/path.test.ts covering URL-encoded and literal CRLF/LF/CR/tab injection after a leading slash.

Docs

No docs changes needed — internal behavior only.

changeset-bot · 2026-04-30T18:47:08Z

🦋 Changeset detected

Latest commit: 87dcb8d

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

matthewp · 2026-04-30T18:50:34Z

 		// This is only allowed if this is the same origin
 		if (sourceUrl.origin !== url.origin) {
-			returnValue = undefined;
+			return undefined;


this was dead-code before, always would try to load the remote image.

codspeed-hq · 2026-04-30T19:03:57Z

Merging this PR will not alter performance

✅ 18 untouched benchmarks

_{Comparing image-endpoint-cleanup (87dcb8d) with main (5cf6c51)¹}

No successful run was found on main (c1fe832) during the generation of this report, so 5cf6c51 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.3.1` → `6.3.2`](https://renovatebot.com/diffs/npm/astro/6.3.1/6.3.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.3.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.3.1/6.3.2?slim=true) | --- ### Release Notes <details> <summary>withastro/astro (astro)</summary> ### [`v6.3.2`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#632) [Compare Source](https://github.com/withastro/astro/compare/astro@6.3.1...astro@6.3.2) ##### Patch Changes - [#16675](withastro/astro#16675) [`11d4592`](withastro/astro@11d4592) Thanks [@ascorbic](https://github.com/ascorbic)! - Fixes a regression where `Astro.cache` was `undefined` when `experimental.cache` was not configured. The previous documented behavior is for `Astro.cache` to always be defined as a no-op shim: `cache.set()` warns once, `cache.invalidate()` throws and `cache.enabled` can be used to gate. This allows library and user code can call cache methods without conditional checks. The cache provider registration was being gated at the call site on `experimental.cache` being configured, which meant the disabled shim branch inside the provider was unreachable and the `Astro.cache` getter was never attached to the context. - [#16691](withastro/astro#16691) [`0f0a4ce`](withastro/astro@0f0a4ce) Thanks [@matthewp](https://github.com/matthewp)! - Fixes `HTMLElement is not defined` error during HMR when using components with client-side scripts (e.g. Starlight `<Tabs>`) and the Cloudflare adapter - [#16562](withastro/astro#16562) [`07529ec`](withastro/astro@07529ec) Thanks [@matthewp](https://github.com/matthewp)! - Fixes non-prerendered routes failing when a dynamic prerendered route exists in the same project with `prerenderEnvironment: 'node'` - [#16638](withastro/astro#16638) [`272185b`](withastro/astro@272185b) Thanks [@ematipico](https://github.com/ematipico)! - Fixes a bug where the Astro compiler wasn't freed at the end of the build. After the fix, the memory used by the compiler is now correctly freed at the end of the build. - [#16544](withastro/astro#16544) [`d365c97`](withastro/astro@d365c97) Thanks [@matthewp](https://github.com/matthewp)! - Tightens `isRemotePath()` to reject control characters after a leading slash and fixes the dev image endpoint origin check - [#16685](withastro/astro#16685) [`889e748`](withastro/astro@889e748) Thanks [@farrosfr](https://github.com/farrosfr)! - Improve validation messages for `security.csp.directives` when `script-src` or `style-src` are incorrectly placed in the `directives` array. - [#16605](withastro/astro#16605) [`772f13a`](withastro/astro@772f13a) Thanks [@rururux](https://github.com/rururux)! - Fixes `assetsPrefix` not being available on `build` from `astro:config/server`. - [#16556](withastro/astro#16556) [`f38dec7`](withastro/astro@f38dec7) Thanks [@matthewp](https://github.com/matthewp)! - Rejects double-encoded URL paths with a 400 response instead of silently falling back to partial decoding - [#16659](withastro/astro#16659) [`38bcb25`](withastro/astro@38bcb25) Thanks [@jsparkdev](https://github.com/jsparkdev)! - Fixes `&` characters appearing as raw entity strings (e.g. `&#38;`) in `<meta>` tags when viewed in link previews or raw HTML. - Updated dependencies \[[`d365c97`](withastro/astro@d365c97), [`9256345`](withastro/astro@9256345)]: - [@astrojs/internal-helpers](https://github.com/astrojs/internal-helpers)@0.9.1 - [@astrojs/markdown-remark](https://github.com/astrojs/markdown-remark)@7.1.2 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

Tighten isRemotePath and dev image endpoint origin check

90ae918

github-actions Bot added the pkg: astro Related to the core `astro` package (scope) label Apr 30, 2026

Use \w in regex to satisfy eslint regexp/prefer-w

87dcb8d

matthewp commented Apr 30, 2026

View reviewed changes

matthewp marked this pull request as ready for review April 30, 2026 19:17

Princesseuh approved these changes May 8, 2026

View reviewed changes

matthewp merged commit d365c97 into main May 8, 2026
27 checks passed

matthewp deleted the image-endpoint-cleanup branch May 8, 2026 15:48

astrobot-houston mentioned this pull request May 8, 2026

[ci] release #16653

Merged

github-actions Bot mentioned this pull request May 18, 2026

fix(deps): update @astrojs packages lacolaco/blog.lacolaco.net#1687

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Tighten image endpoint path handling#16544

Tighten image endpoint path handling#16544
matthewp merged 2 commits into
mainfrom
image-endpoint-cleanup

matthewp commented Apr 30, 2026

Uh oh!

changeset-bot Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

matthewp Apr 30, 2026

Uh oh!

codspeed-hq Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

matthewp commented Apr 30, 2026

Changes

Testing

Docs

Uh oh!

changeset-bot Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

matthewp Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

codspeed-hq Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Apr 30, 2026 •

edited

Loading

codspeed-hq Bot commented Apr 30, 2026 •

edited

Loading