Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix(glob): throw on page.route() for unbalanced braces in glob patterns by Thavamani13 · Pull Request #40442 · microsoft/playwright · GitHub
Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt
, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix(glob): throw on page.route() for unbalanced braces in glob patterns by Thavamani13 · Pull Request #40442 · microsoft/playwright · GitHub
Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt
, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix(glob): throw on page.route() for unbalanced braces in glob patterns by Thavamani13 · Pull Request #40442 · microsoft/playwright · GitHub
Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt
, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' fix(glob): throw on page.route() for unbalanced braces in glob patterns by Thavamani13 · Pull Request #40442 · microsoft/playwright · GitHub
Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt
, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' fix(glob): throw on page.route() for unbalanced braces in glob patterns by Thavamani13 · Pull Request #40442 · microsoft/playwright · GitHub
Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt
, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(glob): throw on page.route() for unbalanced braces in glob patterns by Thavamani13 · Pull Request #40442 · microsoft/playwright · GitHub
Skip to content

fix(glob): throw on page.route() for unbalanced braces in glob patterns - #40442

Closed
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2
Closed

fix(glob): throw on page.route() for unbalanced braces in glob patterns#40442
Thavamani Murugan (Thavamani13) wants to merge 2 commits into
microsoft:mainfrom
Thavamani13:fix-40422-v2

Conversation

@Thavamani13

Copy link
Copy Markdown

Summary

  • globToRegexPattern() now throws a descriptive error for nested {, unmatched }, and unclosed {
  • RouteHandler and WebSocketRouteHandler constructors call resolveGlobToRegexPattern() eagerly so the error surfaces immediately when page.route() / context.route() is called, not silently at request-match time
  • Added test covering all three invalid cases

Fixes#40422

Validates glob patterns eagerly in RouteHandler and WebSocketRouteHandler
constructors so an invalid pattern like '{foo' throws immediately when
page.route() / context.route() is called, rather than silently aborting
requests at match time via a SyntaxError from new RegExp().
Fixes: microsoft#40422
constructor(baseURL: string | undefined, url: URLMatch, handler: WebSocketRouteHandlerCallback) {
this._baseURL = baseURL;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's move this to the dispatcher / server side, so it also applies to our language ports.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved it Simon Knott (@Skn0tt) Please check

Move glob pattern validation from the client-side WebSocketRouteHandler
constructor to setWebSocketInterceptionPatterns in both BrowserContext and
Page dispatchers, so the error also surfaces for language ports.
@github-actions

Copy link
Copy Markdown
Contributor

Test results for "tests 1"

9 flaky⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@ubuntu-22.04-chromium-tip-of-tree`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/video.spec.ts:647 › screencast › should capture full viewport `@chromium-ubuntu-22.04-arm-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node24`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-node20`
⚠️ [chromium-library] › library/chromium/connect-over-cdp.spec.ts:449 › should be able to connect via localhost `@chromium-ubuntu-22.04-node22`
⚠️ [firefox-library] › library/inspector/cli-codegen-1.spec.ts:1080 › cli codegen › should not throw csp directive violation errors `@firefox-ubuntu-22.04-node20`
⚠️ [firefox-page] › page/page-wait-for-function.spec.ts:104 › should work with strict CSP policy `@firefox-ubuntu-22.04-node20`

41467 passed, 847 skipped


Merge workflow run.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for "MCP"

1 failed
❌ [chrome] › mcp/dashboard.spec.ts:231 › should switch screencast to -s session on show --annotate @mcp-windows-latest

6651 passed, 927 skipped


Merge workflow run.

this._baseURL = baseURL;
this._times = times;
this.url = url;
if (isString(url))

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

_updateInterceptionPatterns is called next line at both constructions sites and it does the glob validation on the server, do we still need to duplicate the logic here?

@pavelfeldman

Pavel Feldman (pavelfeldman) commented May 4, 2026

Copy link
Copy Markdown
Member

I'll close it for #40614. We assign trivial issues to copilot, no need to send the PRs (see contributors' guide)

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

page.route() silently aborts navigation when glob contains unbalanced { or }

4 participants

@Thavamani13@pavelfeldman@yury-s@Skn0tt