Skip to content

Encode dots in URL path segments to prevent browser resolution #3746

Open
DL6ER wants to merge 1 commit intodevelopmentfrom
fix/regex_pathlike
Open

Encode dots in URL path segments to prevent browser resolution #3746
DL6ER wants to merge 1 commit intodevelopmentfrom
fix/regex_pathlike

Conversation

@DL6ER
Copy link
Copy Markdown
Member

@DL6ER DL6ER commented Mar 25, 2026

What does this implement/fix?

When editing a regex domain that is just "." (single dot), the browser
interprets it as a relative path component ("current directory") and
resolves it away before sending the request. The server receives an
empty string, causing "Invalid request: Specify item in URI".

This happens because encodeURIComponent(".") returns "." unchanged —
dots are unreserved characters per RFC 3986. The browser only normalizes
literal "." and ".." path segments, not percent-encoded "%2E".

Add utils.encodePathSegment() which wraps encodeURIComponent and also
encodes dots to %2E, then apply it in groups-domains.js (the reported
bug) and groups.js (which was also missing encoding entirely).


Related issue or feature (if applicable): Fixes #3308

Pull request in docs with documentation (if applicable): N/A


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)

Checklist:

  • The code change is tested and works locally.
  • I based my code and PRs against the repositories development branch.
  • I signed off all commits. Pi-hole enforces the DCO for all contributions
  • I signed all my commits. Pi-hole requires signatures to verify authorship
  • I have read the above and my PR is ready for review.

…3308)

When editing a regex domain that is just "." (single dot), the browser
interprets it as a relative path component ("current directory") and
resolves it away before sending the request. The server receives an
empty string, causing "Invalid request: Specify item in URI".

This happens because encodeURIComponent(".") returns "." unchanged —
dots are unreserved characters per RFC 3986. The browser only normalizes
literal "." and ".." path segments, not percent-encoded "%2E".

Add utils.encodePathSegment() which wraps encodeURIComponent and also
encodes dots to %2E, then apply it in groups-domains.js (the reported
bug) and groups.js (which was also missing encoding entirely).

Fixes #3308

Signed-off-by: Dominik <dl6er@dl6er.de>
@DL6ER DL6ER requested a review from a team as a code owner March 25, 2026 06:05
@DL6ER DL6ER added the Bugfix label Mar 25, 2026
@DL6ER DL6ER changed the title Fix/regex pathlike Encode dots in URL path segments to prevent browser resolution Mar 25, 2026
@yubiuser yubiuser linked an issue Mar 25, 2026 that may be closed by this pull request
Copy link
Copy Markdown
Member

@yubiuser yubiuser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried it and still get a 400 response.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Regex Domain . can not be edited after Update to v6.0.5

2 participants