Detect numeric csv in route params

Author: timokoessler

library/helpers/buildRouteFromURL.test.ts

@@ -36,10 +36,6 @@ t.test("it replaces dates", async () => {
   t.same(buildRouteFromURL("/posts/01-05-2023"), "/posts/:date");
 });
 
-t.test("it ignores comma numbers", async () => {
-  t.same(buildRouteFromURL("/posts/3,000"), "/posts/3,000");
-});
-
 t.test("it ignores API version numbers", async () => {
   t.same(buildRouteFromURL("/v1/posts/3"), "/v1/posts/:number");
 });
@@ -186,3 +182,18 @@ t.test("it does not detect static files as secrets", async () => {
     t.same(buildRouteFromURL(`/assets/${file}`), `/assets/${file}`);
   }
 });
+
+t.test("it detects numeric comma separated arrays", async (t) => {
+  t.same(buildRouteFromURL("/users/1,2"), "/users/:array(number)");
+  t.same(buildRouteFromURL("/users/1,2,3,4,5"), "/users/:array(number)");
+  t.same(
+    buildRouteFromURL("/users/100,200,3000000,40000000,500000000"),
+    "/users/:array(number)"
+  );
+
+  t.same(buildRouteFromURL("/users/1,2,3,4,"), "/users/1,2,3,4,");
+  t.same(buildRouteFromURL("/users/1,"), "/users/1,");
+  t.same(buildRouteFromURL("/users/,1,2"), "/users/,1,2");
+  t.same(buildRouteFromURL("/users/1,2,3_"), "/users/1,2,3_");
+  t.same(buildRouteFromURL("/users/1,2,3a"), "/users/1,2,3a");
+});

library/helpers/buildRouteFromURL.ts

@@ -13,6 +13,7 @@ const EMAIL =
   /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
 const HASH = /^(?:[a-f0-9]{32}|[a-f0-9]{40}|[a-f0-9]{64}|[a-f0-9]{128})$/i;
 const HASH_LENGTHS = [32, 40, 64, 128];
+const NUMBER_ARRAY = /^\d+(?:,\d+)*$/;
 
 export function buildRouteFromURL(url: string) {
   let path = tryParseURLPath(url);
@@ -77,6 +78,10 @@ function replaceURLSegmentWithParam(segment: string) {
     return ":hash";
   }
 
+  if (startsWithNumber && NUMBER_ARRAY.test(segment)) {
+    return ":array(number)";
+  }
+
   if (looksLikeASecret(segment)) {
     return ":secret";
   }