Description
If a client sends a request with a URL containing characters that new URL() cannot parse, the server crashes with an unhandled exception because there's no try/catch around the URL constructor in the request handler.
Steps to reproduce
curl --path-as-is "http://localhost:3000/%%%invalid"
Expected behavior
Should return 400 Bad Request with an error message, and the server should continue running.
Actual behavior
The server process crashes with TypeError: Invalid URL and must be restarted manually. This means a single malformed request takes down the entire service.
Suggested fix
Wrap the URL parsing in a try/catch at the top of the request handler, returning a 400 response on failure.
Description
If a client sends a request with a URL containing characters that
new URL()cannot parse, the server crashes with an unhandled exception because there's no try/catch around the URL constructor in the request handler.Steps to reproduce
curl --path-as-is "http://localhost:3000/%%%invalid"Expected behavior
Should return
400 Bad Requestwith an error message, and the server should continue running.Actual behavior
The server process crashes with
TypeError: Invalid URLand must be restarted manually. This means a single malformed request takes down the entire service.Suggested fix
Wrap the URL parsing in a try/catch at the top of the request handler, returning a 400 response on failure.