Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent double uri decoding #9532

Merged
merged 1 commit into from
Dec 27, 2023
Merged

Prevent double uri decoding #9532

merged 1 commit into from
Dec 27, 2023

Conversation

bluwy
Copy link
Member

@bluwy bluwy commented Dec 27, 2023

Changes

Fix #7374

Prevent unnecessary decoding in certain places. I'll add comments below to explain it.

Testing

Added a test

Docs

n/a. bug fix.

Copy link

changeset-bot bot commented Dec 27, 2023

🦋 Changeset detected

Latest commit: 1692f1e

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions github-actions bot added pkg: astro Related to the core `astro` package (scope) pr: docs A PR that includes documentation for review labels Dec 27, 2023
Comment on lines -15 to +17
params[key.slice(3)] = match[i + 1] ? decodeURIComponent(match[i + 1]) : undefined;
params[key.slice(3)] = match[i + 1] ? match[i + 1] : undefined;
} else {
params[key] = decodeURIComponent(match[i + 1]);
params[key] = match[i + 1];
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This getParams function is being called at

function getRouteParams(route: RouteData, pathname: string): Params | undefined {
if (route.params.length) {
// The RegExp pattern expects a decoded string, but the pathname is encoded
// when the URL contains non-English characters.
const paramsMatch = route.pattern.exec(decodeURIComponent(pathname));
if (paramsMatch) {
return getParams(route.params)(paramsMatch);
}
}
}

As shown, it already calls decodeURIComponent, so we don't have to call decodeURIComponent here too.

pathname = decodeURI(url.pathname);
pathname = url.pathname;
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't look like we need to decode it here. It also doesn't work well with the line below:

// Add config.base back to url before passing it to SSR
url.pathname = removeTrailingForwardSlash(config.base) + url.pathname;

(URLs are always encoded)

Removing this decodeURI seems to not break things. It affects dev only. The prod SSR "app" also doesn't decode the url, so I think this makes it more consistent.

@matthewp matthewp merged commit 7224809 into main Dec 27, 2023
13 checks passed
@matthewp matthewp deleted the no-double-decode branch December 27, 2023 17:34
@astrobot-houston astrobot-houston mentioned this pull request Dec 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkg: astro Related to the core `astro` package (scope) pr: docs A PR that includes documentation for review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Route parameter with uri-encoded percent sign character (%) causes error in SSR
2 participants