Security: Could Sveltekit please expose a function, to check if a string is a valid routable route in the app

[alexbjorlig]

The Problem

I need to determine whether a given string, such as tenantname/abc/fge, matches one of the valid routes in our app. The challenge is to correctly interpret the dynamic segments (e.g., [tenant=org_slug]) and validate if the input string aligns with the defined route pattern.

Expected Behavior

• Dynamic Segment Handling: The validation logic should recognize and correctly match dynamic segments in the route patterns.
• Input Validation: For an input like tenantname/abc/fge, the system should confirm if it corresponds to a valid SvelteKit route (e.g., /app/[tenant=org_slug]/abc/fge).
• Security: As this functionality is used for validating redirect_uris, ensuring robust and secure validation is critical.

Implementation Ideas

1. Convert Route Patterns to Regular Expressions:
   Transform SvelteKit route patterns into regular expressions. For example, convert [tenant=org_slug] into a regex pattern that matches valid tenant names.

2. Pre-generate Route Mappings:
   Consider generating a mapping of all valid route patterns at build time from route_meta_data.json. This mapping can then be used at runtime to efficiently validate redirect_uris.

3. Validation Function:
   Create a function that iterates over the list of valid route patterns (or regexes) and checks if the provided redirect_uri matches any of them.

4. Error Handling:
   Ensure that the function provides clear feedback when a redirect_uri is not valid, possibly logging or handling errors in a way that prevents misuse or security issues.

Discussion Points

• Optional Segments: How should optional segments be handled if they exist in the route definitions?
• Performance: The solution should be efficient since validation might occur frequently.
• Security Considerations: As improper validation could lead to open redirect vulnerabilities, extra care is needed to sanitize inputs and ensure that only valid routes are accepted.

[david-plugge]

I'd love to know the reason why the validation is needed in your example