fix: ensure that the urlPathname is always a pathname

packages/next/src/server/app-render/app-render.tsx

@@ -1426,8 +1426,7 @@ export const renderToHTMLOrFlight: AppPageRender = (
   query,
   renderOpts
 ) => {
-  // TODO: this includes query string, should it?
-  const pathname = validateURL(req.url)
+  const { pathname } = validateURL(req.url)
 
   return RequestAsyncStorageWrapper.wrap(
     renderOpts.ComponentMod.requestAsyncStorage,

packages/next/src/server/app-render/validate-url.test.ts

@@ -0,0 +1,13 @@
+import { validateURL } from './validate-url'
+
+describe('validateUrl', () => {
+  it('should return valid pathname', () => {
+    expect(validateURL('/').pathname).toBe('/')
+    expect(validateURL('/abc').pathname).toBe('/abc')
+  })
+
+  it('should throw for invalid pathname', () => {
+    expect(() => validateURL('//**y/\\')).toThrow()
+    expect(() => validateURL('//google.com')).toThrow()
+  })
+})

packages/next/src/server/app-render/validate-url.tsx → packages/next/src/server/app-render/validate-url.ts

@@ -1,7 +1,7 @@
 const DUMMY_ORIGIN = 'http://n'
 const INVALID_URL_MESSAGE = 'Invalid request URL'
 
-export function validateURL(url: string | undefined): string {
+export function validateURL(url: string | undefined): URL {
   if (!url) {
     throw new Error(INVALID_URL_MESSAGE)
   }
@@ -11,7 +11,7 @@ export function validateURL(url: string | undefined): string {
     if (parsed.origin !== DUMMY_ORIGIN) {
       throw new Error(INVALID_URL_MESSAGE)
     }
-    return url
+    return parsed
   } catch {
     throw new Error(INVALID_URL_MESSAGE)
   }