fix(routing): throw on unbalanced braces in route glob patterns

packages/isomorphic/urlMatch.ts

@@ -64,10 +64,14 @@ export function globToRegexPattern(glob: string): string {
 
     switch (c) {
       case '{':
+        if (inGroup)
+          throw new Error(`Invalid glob pattern ${JSON.stringify(glob)}: nested '{' is not supported`);
         inGroup = true;
         tokens.push('(');
         break;
       case '}':
+        if (!inGroup)
+          throw new Error(`Invalid glob pattern ${JSON.stringify(glob)}: unmatched '}'`);
         inGroup = false;
         tokens.push(')');
         break;
@@ -82,6 +86,8 @@ export function globToRegexPattern(glob: string): string {
         tokens.push(escapedChars.has(c) ? '\\' + c : c);
     }
   }
+  if (inGroup)
+    throw new Error(`Invalid glob pattern ${JSON.stringify(glob)}: unmatched '{'`);
   tokens.push('$');
   return tokens.join('');
 }

packages/playwright-core/src/client/network.ts

@@ -16,7 +16,7 @@
 
 import { assert } from '@isomorphic/assert';
 import { headersObjectToArray } from '@isomorphic/headers';
-import { serializeURLMatch, urlMatches } from '@isomorphic/urlMatch';
+import { resolveGlobToRegexPattern, serializeURLMatch, urlMatches } from '@isomorphic/urlMatch';
 import { LongStandingScope, ManualPromise } from '@isomorphic/manualPromise';
 import { MultiMap } from '@isomorphic/multimap';
 import { isString } from '@isomorphic/rtti';
@@ -591,6 +591,10 @@ export class WebSocketRouteHandler {
     this._baseURL = baseURL;
     this.url = url;
     this.handler = handler;
+    // Eagerly validate string globs so that invalid patterns throw at the call site
+    // (e.g. page.routeWebSocket()) rather than silently failing later.
+    if (typeof url === 'string')
+      resolveGlobToRegexPattern(baseURL, url, true);
   }
 
   static prepareInterceptionPatterns(handlers: WebSocketRouteHandler[]) {
@@ -836,6 +840,10 @@ export class RouteHandler {
     this.url = url;
     this.handler = handler;
     this._savedZone = platform.zones.current().pop();
+    // Eagerly validate string globs so that invalid patterns throw at the call site
+    // (e.g. page.route()) rather than silently aborting requests later.
+    if (typeof url === 'string')
+      resolveGlobToRegexPattern(baseURL, url);
   }
 
   static prepareInterceptionPatterns(handlers: RouteHandler[]) {

tests/page/interception.spec.ts

@@ -166,6 +166,22 @@ it('should work with glob', async () => {
   }
 });
 
+it('should throw on unbalanced glob braces', async () => {
+  expect(() => globToRegexPattern('{foo')).toThrow(`Invalid glob pattern "{foo": unmatched '{'`);
+  expect(() => globToRegexPattern('}foo')).toThrow(`Invalid glob pattern "}foo": unmatched '}'`);
+  expect(() => globToRegexPattern('http://*/foo{')).toThrow(`unmatched '{'`);
+  expect(() => globToRegexPattern('**/*.png?{')).toThrow(`unmatched '{'`);
+  expect(() => globToRegexPattern('https://example.com/{a')).toThrow(`unmatched '{'`);
+  expect(() => globToRegexPattern('{{foo}')).toThrow(`nested '{' is not supported`);
+  // Escaped braces remain literal and must not throw.
+  expect(() => globToRegexPattern('\\{foo')).not.toThrow();
+  expect(() => globToRegexPattern('foo\\}')).not.toThrow();
+});
+
+it('should throw on page.route with invalid glob', async ({ page }) => {
+  await expect(page.route('http://*/foo{', route => route.continue())).rejects.toThrow(`unmatched '{'`);
+});
+
 it('should intercept by glob', async function({ page, server, isAndroid }) {
   it.skip(isAndroid);