Middleware Broad Matcher

1export const metadata = {
2  id: 'middleware-broad-matcher',
3  title: 'Middleware matcher missing or too broad',
4  severity: 'high',
5  billingDimension: 'edge-requests',
6  trafficIndependent: true,
7  description:
8    'middleware.ts without a config.matcher (or matcher: ["/(.*)"]) runs on every request including _next/static, _next/image, favicon.ico, and image asset fetches. Edge-request cost scales accordingly.',
9  fix:
10    'Scope the matcher to actual application paths. Example: matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)"]',
11  citations: [
12    'https://nextjs.org/docs/app/building-your-application/routing/middleware',
13  ],
14  excludeGlobs: ['node_modules/**', '.next/**', 'dist/**', '__tests__/**'],
15  includeGlobs: ['middleware.{ts,js,mjs}', 'src/middleware.{ts,js,mjs}'],
16};
17
18export function scan({ files }) {
19  const out = [];
20  for (const { path, content } of files) {
21    if (!isApplicable(path)) continue;
22
23    const exportsMiddleware = /export\s+(default\s+)?(async\s+)?function\s+middleware/.test(content)
24      || /export\s+const\s+middleware\s*=/.test(content);
25    if (!exportsMiddleware) continue;
26
27    const configBlock = content.match(/export\s+const\s+config\s*=\s*\{([\s\S]*?)\}/);
28    const matcherStr = configBlock && configBlock[1].match(/matcher\s*:\s*([^,}]+)/);
29
30    let problem = null;
31    if (!configBlock || !matcherStr) {
32      problem = 'no config.matcher (runs on every request)';
33    } else {
34      const m = matcherStr[1];
35      if (/['"`]\s*\/\s*['"`]/.test(m) || /['"`]\/\(\.\*\)['"`]/.test(m)) {
36        problem = 'matcher = "/" or "/(.*)" (still covers everything)';
37      }
38    }
39
40    if (problem) {
41      out.push({
42        pattern: metadata.id,
43        file: path,
44        line: 1,
45        evidence: problem,
46        trafficIndependent: metadata.trafficIndependent,
47      });
48    }
49  }
50  return out;
51}
52
53function isApplicable(path) {
54  return /(^|\/)middleware\.(ts|js|mjs)$/.test(path);
55}