WEB-64 Validation of paths

src/lib/actions.ts

@@ -23,10 +23,45 @@ import type {
 } from "./types";
 import { wrapAction } from "./wrap-action";
 
+const ROUTE_SEGMENT_RE = /^[a-z0-9_-]+$/;
+
 function assertValidRoutePath(path: string): void {
+  if (path.trim() !== path) {
+    throw new Error("Path cannot have leading or trailing whitespace");
+  }
+
+  if (path.length === 0) {
+    throw new Error("Path cannot be empty");
+  }
+
   if (!path.startsWith("/")) {
     throw new Error("Path must start with /");
   }
+
+  if (path === "/") {
+    return;
+  }
+
+  if (path.endsWith("/")) {
+    throw new Error("Path must not end with / (except root /)");
+  }
+
+  if (path.includes("//")) {
+    throw new Error("Path must not contain consecutive slashes");
+  }
+
+  if (path !== path.toLowerCase()) {
+    throw new Error("Path must be lowercase");
+  }
+
+  const segments = path.split("/").slice(1);
+  for (const segment of segments) {
+    if (!ROUTE_SEGMENT_RE.test(segment)) {
+      throw new Error(
+        "Each path segment may only contain lowercase letters, numbers, hyphens, and underscores"
+      );
+    }
+  }
 }
 
 export async function createDocumentAction(