[PR #107] [MERGED] fix: handle malformed percent-encoded URLs gracefully #316

New issue

Closed

opened 2026-05-06 12:39:09 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:09 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/107
Author: @threepointone
Created: 2/26/2026
Status: ✅ Merged
Merged: 2/26/2026
Merged by: @threepointone

Base: main ← Head: fix/malformed-percent-encoding-dos

📝 Commits (1)

c02ae12 fix: handle malformed percent-encoded URLs gracefully

📊 Changes

8 files changed (+159 additions, -8 deletions)

View changed files

📝 packages/vinext/src/index.ts (+15 -3)
📝 packages/vinext/src/server/app-dev-server.ts (+5 -1)
📝 packages/vinext/src/server/app-router-entry.ts (+7 -1)
📝 packages/vinext/src/server/middleware.ts (+8 -1)
📝 packages/vinext/src/server/prod-server.ts (+18 -2)
📝 tests/app-router.test.ts (+47 -0)
📝 tests/features.test.ts (+45 -0)
📝 tests/pages-router.test.ts (+14 -0)

📄 Description

Problem

decodeURIComponent() on attacker-controlled request paths throws URIError: URI malformed for invalid percent sequences (e.g. /%E0%A4%A). When this happens outside a try/catch in a request handler, the uncaught exception terminates the Node process — a single malformed request causes full service outage.

Fix

Wrap all decodeURIComponent calls on user-controlled input in try/catch across every server entry point. On decode failure, return 400 Bad Request and continue serving.

Files changed

File	Fix
`prod-server.ts`	App Router + Pages Router request handlers
`app-router-entry.ts`	Cloudflare Worker entry
`app-dev-server.ts`	Generated RSC entry handler
`index.ts`	Dev server connect middleware, generated middleware runner, NEXT_LOCALE cookie parser
`middleware.ts`	Pages Router dev middleware runner

Tests

11 regression tests added across three test files:

app-router.test.ts — App Router prod server + dev server (5 tests)
pages-router.test.ts — Pages Router prod server (2 tests)
features.test.ts — Pages Router dev server (4 tests)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/107 **Author:** [@threepointone](https://github.com/threepointone) **Created:** 2/26/2026 **Status:** ✅ Merged **Merged:** 2/26/2026 **Merged by:** [@threepointone](https://github.com/threepointone) **Base:** `main` ← **Head:** `fix/malformed-percent-encoding-dos` --- ### 📝 Commits (1) - [`c02ae12`](https://github.com/cloudflare/vinext/commit/c02ae1272950c1b88eca17b1600dfef627629b29) fix: handle malformed percent-encoded URLs gracefully ### 📊 Changes **8 files changed** (+159 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/index.ts` (+15 -3) 📝 `packages/vinext/src/server/app-dev-server.ts` (+5 -1) 📝 `packages/vinext/src/server/app-router-entry.ts` (+7 -1) 📝 `packages/vinext/src/server/middleware.ts` (+8 -1) 📝 `packages/vinext/src/server/prod-server.ts` (+18 -2) 📝 `tests/app-router.test.ts` (+47 -0) 📝 `tests/features.test.ts` (+45 -0) 📝 `tests/pages-router.test.ts` (+14 -0) </details> ### 📄 Description ## Problem `decodeURIComponent()` on attacker-controlled request paths throws `URIError: URI malformed` for invalid percent sequences (e.g. `/%E0%A4%A`). When this happens outside a try/catch in a request handler, the uncaught exception terminates the Node process — a single malformed request causes full service outage. ## Fix Wrap all `decodeURIComponent` calls on user-controlled input in try/catch across every server entry point. On decode failure, return **400 Bad Request** and continue serving. ### Files changed | File | Fix | |------|-----| | `prod-server.ts` | App Router + Pages Router request handlers | | `app-router-entry.ts` | Cloudflare Worker entry | | `app-dev-server.ts` | Generated RSC entry handler | | `index.ts` | Dev server connect middleware, generated middleware runner, NEXT_LOCALE cookie parser | | `middleware.ts` | Pages Router dev middleware runner | ### Tests 11 regression tests added across three test files: - `app-router.test.ts` — App Router prod server + dev server (5 tests) - `pages-router.test.ts` — Pages Router prod server (2 tests) - `features.test.ts` — Pages Router dev server (4 tests) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>