fix(assets): Ensure remotePatterns globs don't match unexpected paths (#15779)

Author: Princesseuh

.changeset/perky-dots-prove.md

@@ -0,0 +1,5 @@
+---
+'@astrojs/internal-helpers': patch
+---
+
+Fixes glob matching of remote patterns matching more paths than intended in select situations

packages/astro/test/units/remote-pattern.test.js

@@ -92,6 +92,12 @@ describe('remote-pattern', () => {
 			assert.equal(matchPathname(url2, '/*', true), false);
 		});
 
+		it('does not match pathname when prefix appears mid-path', async () => {
+			// /en/* should NOT match /evil/en/getting-started
+			const evilUrl = new URL('https://docs.astro.build/evil/en/getting-started');
+			assert.equal(matchPathname(evilUrl, '/en/*', true), false);
+		});
+
 		it('matches patterns', async () => {
 			assert.equal(matchPattern(url1, {}), true);
 

packages/internal-helpers/src/remote.ts

@@ -92,8 +92,11 @@ export function matchPathname(url: URL, pathname?: string, allowWildcard = false
 		return slicedPathname !== url.pathname && url.pathname.startsWith(slicedPathname);
 	} else if (pathname.endsWith('/*')) {
 		const slicedPathname = pathname.slice(0, -1); // * length
+		if (!url.pathname.startsWith(slicedPathname)) {
+			return false;
+		}
 		const additionalPathChunks = url.pathname
-			.replace(slicedPathname, '')
+			.slice(slicedPathname.length)
 			.split('/')
 			.filter(Boolean);
 		return additionalPathChunks.length === 1;