fix(router-core): reject overlapping parameter affixes (#8154)

* fix(router-core): reject overlapping parameter affixes

* perf(router-core): reduce affix overlap check size

* test(router-core): assert affix match parameters

* ci: apply automated fixes

* perf(router-core): normalize route affixes

* ci: apply automated fixes

* add test case

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: Sheraff

packages/router-core/src/new-process-route-tree.ts

@@ -237,20 +237,13 @@ function parseSegments<TRouteLike extends RouteLike>(
         case SEGMENT_TYPE_PARAM:
         case SEGMENT_TYPE_OPTIONAL_PARAM:
         case SEGMENT_TYPE_WILDCARD: {
-          const prefix_raw = path.substring(start, segment[1])
-          const suffix_raw = path.substring(segment[4], end)
-          const actuallyCaseSensitive =
-            caseSensitive && !!(prefix_raw || suffix_raw)
-          const prefix = !prefix_raw
-            ? undefined
-            : actuallyCaseSensitive
-              ? prefix_raw
-              : prefix_raw.toLowerCase()
-          const suffix = !suffix_raw
-            ? undefined
-            : actuallyCaseSensitive
-              ? suffix_raw
-              : suffix_raw.toLowerCase()
+          let prefix = path.substring(start, segment[1])
+          let suffix = path.substring(segment[4], end)
+          const actuallyCaseSensitive = caseSensitive && !!(prefix || suffix)
+          if (!caseSensitive) {
+            prefix = prefix.toLowerCase()
+            suffix = suffix.toLowerCase()
+          }
           const siblings =
             kind === SEGMENT_TYPE_PARAM
               ? node.dynamic
@@ -357,15 +350,15 @@ function parseSegments<TRouteLike extends RouteLike>(
 
 function sortDynamic(
   a: {
-    prefix?: string
-    suffix?: string
+    prefix: string
+    suffix: string
     caseSensitive: boolean
     parse: null | ((params: Record<string, string>) => unknown)
     priority: number
   },
   b: {
-    prefix?: string
-    suffix?: string
+    prefix: string
+    suffix: string
     caseSensitive: boolean
     parse: null | ((params: Record<string, string>) => unknown)
     priority: number
@@ -426,8 +419,8 @@ function createDynamicNode<T extends RouteLike>(
     | typeof SEGMENT_TYPE_OPTIONAL_PARAM,
   fullPath: string,
   caseSensitive: boolean,
-  prefix?: string,
-  suffix?: string,
+  prefix: string,
+  suffix: string,
 ): DynamicSegmentNode<T> {
   return {
     kind,
@@ -462,8 +455,8 @@ type DynamicSegmentNode<T extends RouteLike> = SegmentNode<T> & {
     | typeof SEGMENT_TYPE_PARAM
     | typeof SEGMENT_TYPE_WILDCARD
     | typeof SEGMENT_TYPE_OPTIONAL_PARAM
-  prefix?: string
-  suffix?: string
+  prefix: string
+  suffix: string
   caseSensitive: boolean
 }
 
@@ -818,12 +811,12 @@ function extractParams<T extends RouteLike>(
     if (node.kind === SEGMENT_TYPE_PARAM) {
       nodeParts ??= leaf.node.fullPath.split('/')
       const nodePart = nodeParts[segmentCount]!
-      const preLength = node.prefix?.length ?? 0
+      const preLength = node.prefix.length
       // we can't rely on the presence of prefix/suffix to know whether it's curly-braced or not, because `/{$param}/` is valid, but has no prefix/suffix
       const isCurlyBraced = nodePart.charCodeAt(preLength) === 123 // '{'
       // param name is extracted at match-time so that tree nodes that are identical except for param name can share the same node
       if (isCurlyBraced) {
-        const sufLength = node.suffix?.length ?? 0
+        const sufLength = node.suffix.length
         const name = nodePart.substring(
           preLength + 2,
           nodePart.length - sufLength - 1,
@@ -842,8 +835,8 @@ function extractParams<T extends RouteLike>(
       }
       nodeParts ??= leaf.node.fullPath.split('/')
       const nodePart = nodeParts[segmentCount]!
-      const preLength = node.prefix?.length ?? 0
-      const sufLength = node.suffix?.length ?? 0
+      const preLength = node.prefix.length
+      const sufLength = node.suffix.length
       const name = nodePart.substring(
         preLength + 3,
         nodePart.length - sufLength - 1,
@@ -856,8 +849,8 @@ function extractParams<T extends RouteLike>(
     } else if (node.kind === SEGMENT_TYPE_WILDCARD) {
       const n = node
       const value = path.substring(
-        currentPathIndex + (n.prefix?.length ?? 0),
-        path.length - (n.suffix?.length ?? 0),
+        currentPathIndex + n.prefix.length,
+        path.length - n.suffix.length,
       )
       const splat = decodeURIComponent(value)
       // TODO: Deprecate *
@@ -1061,9 +1054,17 @@ function getNodeMatch<T extends RouteLike>(
         }
         if (suffix) {
           if (isBeyondPath) continue
-          const end = parts.slice(index).join('/').slice(-suffix.length)
-          const casePart = segment.caseSensitive ? end : end.toLowerCase()
-          if (casePart !== suffix) continue
+          const end = parts.slice(index).join('/')
+          const suffixPart = end.slice(-suffix.length)
+          const casePart = segment.caseSensitive
+            ? suffixPart
+            : suffixPart.toLowerCase()
+          if (
+            casePart !== suffix ||
+            end.length - suffix.length < prefix.length
+          ) {
+            continue
+          }
         }
         // wildcard matches consume the rest of the URL and cannot have children
         stack.push({
@@ -1106,7 +1107,13 @@ function getNodeMatch<T extends RouteLike>(
               ? part!
               : (lowerPart ??= part!.toLowerCase())
             if (prefix && !casePart.startsWith(prefix)) continue
-            if (suffix && !casePart.endsWith(suffix)) continue
+            if (
+              suffix &&
+              casePart.indexOf(suffix, casePart.length - suffix.length) <
+                prefix.length
+            ) {
+              continue
+            }
           }
           stack.push({
             node: segment,
@@ -1132,7 +1139,13 @@ function getNodeMatch<T extends RouteLike>(
             ? part
             : (lowerPart ??= part.toLowerCase())
           if (prefix && !casePart.startsWith(prefix)) continue
-          if (suffix && !casePart.endsWith(suffix)) continue
+          if (
+            suffix &&
+            casePart.indexOf(suffix, casePart.length - suffix.length) <
+              prefix.length
+          ) {
+            continue
+          }
         }
         stack.push({
           node: segment,

packages/router-core/tests/new-process-route-tree.test.ts

@@ -627,6 +627,31 @@ describe('findRouteMatch', () => {
         '/A{$id}B',
       )
     })
+    it('case sensitivity does not distinguish plain dynamic segments', () => {
+      const tree = {
+        id: '__root__',
+        isRoot: true,
+        fullPath: '/',
+        path: '/',
+        children: [
+          {
+            id: '/$first',
+            fullPath: '/$first',
+            path: '$first',
+            options: { caseSensitive: false },
+          },
+          {
+            id: '/$second',
+            fullPath: '/$second',
+            path: '$second',
+            options: { caseSensitive: true },
+          },
+        ],
+      }
+      const { processedTree } = processRouteTree(tree)
+
+      expect(findRouteMatch('/value', processedTree)?.route.id).toBe('/$first')
+    })
   })
 
   describe('basic matching', () => {
@@ -686,6 +711,22 @@ describe('findRouteMatch', () => {
           '/file{-$id}.txt',
         )
       })
+      it.each([
+        ['/ab{$id}bc', '/abbc', { id: '' }],
+        ['/ab{-$id}bc', '/abbc', {}],
+        ['/ab{$}bc', '/abbc', { '*': '', _splat: '' }],
+        ['/ab{$}bc', '/abfoo/barbc', { '*': 'foo/bar', _splat: 'foo/bar' }],
+      ] as const)(
+        'does not match overlapping affixes for %s',
+        (route, path, rawParams) => {
+          const tree = makeTree([route])
+          expect(findRouteMatch('/abc', tree)).toBeNull()
+          expect(findRouteMatch(`${path}x`, tree)).toBeNull()
+          const match = findRouteMatch(path, tree)
+          expect(match?.route.id).toBe(route)
+          expect(match?.rawParams).toEqual(rawParams)
+        },
+      )
     })
 
     it('optional at the end can still be omitted', () => {
@@ -1676,7 +1717,7 @@ describe('findRouteMatch', () => {
                   "wildcard": null,
                 },
               ],
-              "prefix": undefined,
+              "prefix": "",
               "priority": 0,
               "route": null,
               "static": null,
@@ -1703,7 +1744,7 @@ describe('findRouteMatch', () => {
                   "wildcard": null,
                 },
               },
-              "suffix": undefined,
+              "suffix": "",
               "wildcard": null,
             },
           ],