[PR #150] [MERGED] fix: use decoded pathname for config matcher evaluation #350

New issue

Closed

opened 2026-05-06 12:39:21 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:21 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/150
Author: @southpolesteve
Created: 2/27/2026
Status: ✅ Merged
Merged: 2/27/2026
Merged by: @southpolesteve

Base: main ← Head: public/fix-decode-pathname-for-config-matchers

📝 Commits (2)

e30f840 fix: use decoded pathname for config matcher evaluation
2473e44 fix: handle malformed percent-encoding in config header path decode

📊 Changes

5 files changed (+170 additions, -3 deletions)

View changed files

📝 packages/vinext/src/server/app-dev-server.ts (+2 -1)
📝 packages/vinext/src/server/prod-server.ts (+6 -2)
📝 tests/app-router.test.ts (+23 -0)
📝 tests/pages-router.test.ts (+50 -0)
📝 tests/shims.test.ts (+89 -0)

📄 Description

Summary

Config matchers (redirects, rewrites, headers from next.config.js) now receive the decoded, normalized pathname so that percent-encoded request paths like /%61bout correctly match rules defined for /about.
Both dev and prod servers rebuild the working URL from the decoded pathname + original query string, ensuring all downstream consumers operate on canonical paths.
Adds unit and integration tests for percent-encoded path handling in config matchers across App Router and Pages Router (dev + prod).

Details

Previously, the prod server's url variable retained the raw (encoded) request URL, so config matchers compared encoded paths like /%61bout against rules expecting /about. This meant requests with percent-encoded characters would miss matching redirects, rewrites, and headers.

The fix decodes and normalizes the pathname at entry, then reconstructs url from the decoded pathname + original query string. The App Router dev server also decodes the pathname before applying config headers.

Error handling for malformed percent-encoding (e.g. /%E0%A4%A) is preserved, returning 400 Bad Request.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/150 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 2/27/2026 **Status:** ✅ Merged **Merged:** 2/27/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `public/fix-decode-pathname-for-config-matchers` --- ### 📝 Commits (2) - [`e30f840`](https://github.com/cloudflare/vinext/commit/e30f84004776963eb577a52554168560288700aa) fix: use decoded pathname for config matcher evaluation - [`2473e44`](https://github.com/cloudflare/vinext/commit/2473e44312d6d516871b6e9ee4135f164a76e9cb) fix: handle malformed percent-encoding in config header path decode ### 📊 Changes **5 files changed** (+170 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-dev-server.ts` (+2 -1) 📝 `packages/vinext/src/server/prod-server.ts` (+6 -2) 📝 `tests/app-router.test.ts` (+23 -0) 📝 `tests/pages-router.test.ts` (+50 -0) 📝 `tests/shims.test.ts` (+89 -0) </details> ### 📄 Description ## Summary - Config matchers (redirects, rewrites, headers from `next.config.js`) now receive the decoded, normalized pathname so that percent-encoded request paths like `/%61bout` correctly match rules defined for `/about`. - Both dev and prod servers rebuild the working URL from the decoded pathname + original query string, ensuring all downstream consumers operate on canonical paths. - Adds unit and integration tests for percent-encoded path handling in config matchers across App Router and Pages Router (dev + prod). ## Details Previously, the prod server's `url` variable retained the raw (encoded) request URL, so config matchers compared encoded paths like `/%61bout` against rules expecting `/about`. This meant requests with percent-encoded characters would miss matching redirects, rewrites, and headers. The fix decodes and normalizes the pathname at entry, then reconstructs `url` from the decoded pathname + original query string. The App Router dev server also decodes the pathname before applying config headers. Error handling for malformed percent-encoding (e.g. `/%E0%A4%A`) is preserved, returning 400 Bad Request. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>