fix: normalize backslashes in image URLs for Windows paths

[rsbh]

Summary

• Normalize backslashes to forward slashes in remark image resolver, image API handler, and safePath util
• Prevents 404s when content uses Windows-style paths (e.g. adminimgs\project_1.png)

Changes

• remark-resolve-images.ts — normalize \ to / before resolving URLs
• image.ts — normalize incoming url param
• safe-path.ts — normalize decoded path before resolution
• Added unit tests for backslash handling in image-utils and safe-path

Test plan

• Image with backslash path resolves correctly
• safePath normalizes backslashes
• No double-encoding in optimized URLs
• Unit tests pass

Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
chronicle	Ready	Preview, Comment	May 22, 2026 6:12am

[coderabbitai]

Warning

Rate limit exceeded

@rsbh has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 30 minutes and 32 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2f85400a-dcd0-4e80-8bb3-c9b84933d295

📥 Commits

Reviewing files that changed from the base of the PR and between ccd29bb and b829383.

📒 Files selected for processing (2)

• packages/chronicle/src/server/utils/safe-path.test.ts
• packages/chronicle/src/server/utils/safe-path.ts

📝 Walkthrough

Walkthrough

This PR normalizes Windows-style backslashes to forward slashes in image paths and URLs across the server API handler, remark markdown plugin, and path safety utility. Test coverage verifies backslash normalization, correct URI encoding, and path traversal safety throughout the pipeline.

Changes

Image Path Backslash Normalization

Layer / File(s)	Summary
Path safety utility normalization packages/chronicle/src/server/utils/safe-path.ts, packages/chronicle/src/server/utils/safe-path.test.ts	safePath converts backslashes to forward slashes in decoded URL paths before resolving against the base directory. Tests verify valid resolution, traversal rejection, backslash normalization, URI decoding, and query string stripping.
Image API query parameter normalization packages/chronicle/src/server/api/image.ts	Handler extracts the url query parameter, validates its presence, and normalizes backslashes to forward slashes before downstream processing.
Markdown image URL resolution normalization packages/chronicle/src/lib/remark-resolve-images.ts	resolveUrl normalizes image source URLs by converting backslashes to forward slashes before applying scheme/protocol-relative/hash/_content/ short-circuits and path joining.
Client-side URL encoding behavior packages/chronicle/src/lib/image-utils.test.ts	Test verifies that buildOptimizedUrl encodes backslashes in input paths as %5C exactly once and does not double-encode them.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• raystack/chronicle#46: Both PRs modify packages/chronicle/src/lib/remark-resolve-images.ts for image URL/path resolution, with this PR adding Windows backslash normalization to the URL rewriting rules.

Suggested reviewers

• rohanchkrabrty
• rohilsurana

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the primary change: normalizing backslashes in image URLs for Windows paths, which directly addresses the main objective of the PR.
Description check	✅ Passed	The description clearly relates to the changeset, explaining the problem (404s with Windows-style paths) and detailing the specific files modified and tests added.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/image-url-encoding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/chronicle/src/server/utils/safe-path.test.ts`:
- Line 3: Replace the relative import of safePath (import { safePath } from
'./safe-path') with the project path alias import using @ so it follows TS/Vite
path mapping; for example change it to import { safePath } from
'`@/server/utils/safe-path`' (i.e., use '`@/`...' instead of './...') so the test
uses the configured `@/`* alias.

In `@packages/chronicle/src/server/utils/safe-path.ts`:
- Line 8: The decodeURIComponent call can throw on malformed percent-escapes, so
guard it: wrap the decodeURIComponent(urlPath.split('?')[0]) call used to
compute the decoded variable in a try/catch and on any error return null (or
otherwise signal an unsafe path) instead of letting the exception bubble;
preserve the subsequent .replace(/\\/g, '/') normalization only when decoding
succeeds so that the decoded variable and any surrounding function (the code
that computes decoded from urlPath) never throw on bad input.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 53c0ca1c-2d6c-4fab-aeaa-70dfaec1898f

📥 Commits

Reviewing files that changed from the base of the PR and between d7bc089 and ccd29bb.

📒 Files selected for processing (5)

• packages/chronicle/src/lib/image-utils.test.ts
• packages/chronicle/src/lib/remark-resolve-images.ts
• packages/chronicle/src/server/api/image.ts
• packages/chronicle/src/server/utils/safe-path.test.ts
• packages/chronicle/src/server/utils/safe-path.ts