Skip to content

Quality: URL pathname can be null, causing path.parse to throw in filesystem utils#39533

Open
Nam0101 wants to merge 1 commit intogatsbyjs:masterfrom
Nam0101:contribai/improve/quality/url-pathname-can-be-null-causing-path-pa
Open

Quality: URL pathname can be null, causing path.parse to throw in filesystem utils#39533
Nam0101 wants to merge 1 commit intogatsbyjs:masterfrom
Nam0101:contribai/improve/quality/url-pathname-can-be-null-causing-path-pa

Conversation

@Nam0101
Copy link
Copy Markdown

@Nam0101 Nam0101 commented Apr 2, 2026

✨ Code Quality

Problem

getParsedPath calls path.parse(Url.parse(url).pathname) without a null fallback. For malformed/edge URL inputs where pathname is null, path.parse throws a TypeError, which can crash callers like getRemoteFileExtension/getRemoteFileName. The TypeScript equivalent in gatsby-core-utils already guards this with || '', indicating this JS version is less safe.

Severity: medium
File: packages/gatsby-source-filesystem/src/utils.js

Solution

Add a safe fallback when parsing the pathname:

function getParsedPath(url) {
return path.parse(Url.parse(url).pathname || ``)
}

Optionally, harden getRemoteFileName against malformed percent-encoding:

export function getRemoteFileName(url) {
const name = getParsedPath(url).name
try {
return decodeURIComponent(name)
} catch {
return name
}
}

Changes

  • packages/gatsby-source-filesystem/src/utils.js (modified)

Description

Documentation

Tests

Related Issues


🤖 About this PR

This pull request was generated by ContribAI, an AI agent
that helps improve open source projects. The change was:

  1. Discovered by automated code analysis
  2. Generated by AI with context-aware code generation
  3. Self-reviewed by AI quality checks

If you have questions or feedback about this PR, please comment below.
We appreciate your time reviewing this contribution!

Closes #39532

… path.parse to throw in filesystem utils

`getParsedPath` calls `path.parse(Url.parse(url).pathname)` without a null fallback. For malformed/edge URL inputs where `pathname` is `null`, `path.parse` throws a `TypeError`, which can crash callers like `getRemoteFileExtension`/`getRemoteFileName`. The TypeScript equivalent in `gatsby-core-utils` already guards this with `|| ''`, indicating this JS version is less safe.


Affected files: utils.js

Signed-off-by: Nguyen Van Nam <nam.nv205106@gmail.com>
@gatsbot gatsbot Bot added the status: triage needed Issue or pull request that need to be triaged and assigned to a reviewer label Apr 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: triage needed Issue or pull request that need to be triaged and assigned to a reviewer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(gatsby-source-filesystem): url pathname can be null, causing path.parse to throw in filesystem utils

1 participant