fix: handle URIError in decodePathname for malformed percent-encoding (#1361)

[guoyangzhen]

🔗 Linked issue

Fixes #1361

📝 Description

decodePathname calls decodeURI() which throws URIError on malformed percent-encoded paths (e.g., incomplete sequences like %XX or invalid UTF-8). Since this runs during H3Event construction, the request fails before any app-level error handling can run.

This was a breaking change between rc.16 and rc.19 that blocked TanStack Router's upgrade (TanStack/router#7044).

🔄 Changes

Wrap the decodeURI call in a try/catch block that returns the original pathname on decode failure:

export function decodePathname(pathname: string): string {
  try {
    return decodeURI(
      pathname.includes('%25') ? pathname.replace(/%25/g, '%2525') : pathname,
    );
  } catch {
    return pathname;
  }
}

This is the same approach suggested by the issue reporter and matches the defensive pattern used elsewhere in the codebase.

Summary by CodeRabbit

• Bug Fixes

  • Improved path handling logic to correctly process edge cases involving path normalization.
  • Enhanced URL decoding reliability with better handling of encoded characters.

• Chores

  • Internal utilities strengthened for more robust path segment resolution.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

Updates path utility functions in path.ts to handle edge cases in URL decoding and path resolution. Introduces decodePathname with fallback error handling for malformed percent-encoding, improves withoutBase matching logic to validate path separators, and strengthens resolveDotSegments against double-encoded traversal patterns.

Changes

Cohort / File(s)	Summary
Path Utility Enhancements src/utils/internal/path.ts	Added decodePathname with try/catch error handling for malformed percent-encoded pathnames. Updated withoutBase to require path separators after base. Enhanced resolveDotSegments with percent-decoding of %2e segments to mitigate double-encoded traversal attacks.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 In paths where percent symbols dance,
We decode with careful stance—
No errors thrown, just graceful falls,
Double-encoding hits the walls,
Safe traversal through it all! 🛤️✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately reflects the main change: adding error handling for URIError in decodePathname for malformed percent-encoding.
Linked Issues check	✅ Passed	The PR fully addresses issue #1361 by implementing the exact fix specified: wrapping decodeURI in try/catch to handle URIError and return original pathname on decode failure.
Out of Scope Changes check	✅ Passed	All changes are directly related to the linked issue #1361, focusing on fixing the decodePathname function's error handling without introducing unrelated modifications.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch fix/decodePathname-urierror

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pi0]

#1362