From b9732ce853433e1aeebbe1cf749b451347e30f35 Mon Sep 17 00:00:00 2001
From: scamiv <6170744+scamiv@users.noreply.github.com>
Date: Mon, 23 Mar 2026 00:58:05 +0100
Subject: [PATCH] Reject empty asset paths

---
 src/core/AssetUrls.ts   | 8 +++++++-
 tests/AssetUrls.test.ts | 7 +++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/core/AssetUrls.ts b/src/core/AssetUrls.ts
index 9a641391e..1f69f0abe 100644
--- a/src/core/AssetUrls.ts
+++ b/src/core/AssetUrls.ts
@@ -30,12 +30,18 @@ export function encodeAssetPath(path: string): string {
 }
 
 export function normalizeAssetPath(path: string): string {
-  return path
+  const normalizedPath = path
     .replace(/^\/+/, "")
     .split("/")
     .filter((segment) => segment.length > 0)
     .map((segment) => assertSafeAssetSegment(segment))
     .join("/");
+
+  if (normalizedPath.length === 0) {
+    throw new Error("Asset path must not be empty");
+  }
+
+  return normalizedPath;
 }
 
 export function buildAssetUrl(
diff --git a/tests/AssetUrls.test.ts b/tests/AssetUrls.test.ts
index 934e629e2..a48876e1b 100644
--- a/tests/AssetUrls.test.ts
+++ b/tests/AssetUrls.test.ts
@@ -36,4 +36,11 @@ describe("AssetUrls", () => {
       "Invalid asset path segment: %2e%2e",
     );
   });
+
+  test("rejects empty asset paths", () => {
+    expect(() => buildAssetUrl("", {})).toThrow("Asset path must not be empty");
+    expect(() => buildAssetUrl("///", {})).toThrow(
+      "Asset path must not be empty",
+    );
+  });
 });