Skip to content

Add bracket safelist to IIS server rules#414

Closed
rezrah wants to merge 7 commits intomainfrom
rezrah/add-bracket-support-to-IIS-server-rules
Closed

Add bracket safelist to IIS server rules#414
rezrah wants to merge 7 commits intomainfrom
rezrah/add-bracket-support-to-IIS-server-rules

Conversation

@rezrah
Copy link
Contributor

@rezrah rezrah commented Jan 26, 2026

Skip trailing slash enforcement of woff2 font files that include brackets (inc. encoded ones)

Copilot AI review requested due to automatic review settings January 26, 2026 12:03
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the IIS rewrite rules generated by script/redirects.js to further refine when the trailing-slash enforcement rule is applied, specifically targeting .woff2 font URLs that contain square brackets (including encoded brackets).

Changes:

  • Adds an additional IIS rewrite condition to exclude URLs with literal brackets in .woff2 filenames from trailing-slash enforcement.
  • Adds a second condition aiming to exclude URLs with URL-encoded brackets (%5B / %5D) in .woff2 filenames from trailing-slash enforcement.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

<add input="{URL}" negate="true" pattern="\\.woff2$" />
<add input="{URL}" negate="true" pattern="\\.webmanifest$" />
<add input="{URL}" negate="true" pattern="\\[.*\\].*\\.woff2$" />
<add input="{URL}" negate="true" pattern="%5B.*%5D.*\\.woff2$" />
Copy link

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you do want to keep a dedicated pattern for encoded brackets, note that %5B / %5D in URLs are case-insensitive hex escapes, so this regex will miss lowercase variants like %5b and %5d. To robustly match encoded brackets regardless of client behavior, consider either using a case-insensitive flag on this condition or adjusting the pattern to accept both uppercase and lowercase hex digits for these sequences.

Suggested change
<add input="{URL}" negate="true" pattern="%5B.*%5D.*\\.woff2$" />
<add input="{URL}" negate="true" pattern="%5B.*%5D.*\\.woff2$" ignoreCase="true" />

Copilot uses AI. Check for mistakes.
Comment on lines 131 to 134
<add input="{URL}" negate="true" pattern="\\.woff2$" />
<add input="{URL}" negate="true" pattern="\\.webmanifest$" />
<add input="{URL}" negate="true" pattern="\\[.*\\].*\\.woff2$" />
<add input="{URL}" negate="true" pattern="%5B.*%5D.*\\.woff2$" />
Copy link

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These two new conditions are logically redundant with the existing pattern="\\.woff2$" condition above. Any URL that matches either of these bracket-specific patterns is already a URL that ends with .woff2, so the negate="true" check on the .woff2 pattern will still cause the trailing-slash rule to be skipped. As written, these additions will not change the behavior of the rule or address the stated goal of exempting bracketed .woff2 URLs from trailing-slash enforcement; if there is still an issue in production, it likely needs to be fixed elsewhere (or by changing/removing the more general .woff2 condition).

Copilot uses AI. Check for mistakes.
@rezrah
Copy link
Contributor Author

rezrah commented Jan 26, 2026

Unable to verify a fix in staging, closing and fixing elsewhere

@rezrah rezrah closed this Jan 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant