[PR #677] [MERGED] fix: percent-encode X-Vinext-Params to allow non-ASCII route params #762

New issue

Closed

opened 2026-05-06 13:09:59 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:09:59 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/677
Author: @southpolesteve
Created: 3/24/2026
Status: ✅ Merged
Merged: 3/24/2026
Merged by: @southpolesteve

Base: main ← Head: fix/non-ascii-params-bytestring-676

📝 Commits (1)

edc637b fix: percent-encode X-Vinext-Params to allow non-ASCII route params (#676)

📊 Changes

3 files changed (+26 additions, -4 deletions)

View changed files

📝 packages/vinext/src/server/app-browser-entry.ts (+2 -2)
📝 packages/vinext/src/server/app-page-response.ts (+3 -1)
📝 tests/app-page-response.test.ts (+21 -1)

📄 Description

Summary

buildAppPageRscResponse was calling Headers.set("X-Vinext-Params", JSON.stringify(params)) with raw Unicode characters in the value
The Fetch spec requires header values to be ByteStrings (each char ≤ U+00FF), so non-ASCII params (Korean, Japanese, etc.) caused a TypeError: Cannot convert argument to a ByteString
Only RSC/client-side navigation was affected — direct SSR requests (buildAppPageHtmlResponse) never set this header

Fix

Encode with encodeURIComponent when setting X-Vinext-Params in app-page-response.ts
Decode with decodeURIComponent in both read sites in app-browser-entry.ts (initial hydration and client-side navigation)

Test

Added a unit test to tests/app-page-response.test.ts that verifies:

The header value is ASCII-safe after encoding
The params round-trip correctly through encode/decode

Closes #676

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/677 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 3/24/2026 **Status:** ✅ Merged **Merged:** 3/24/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/non-ascii-params-bytestring-676` --- ### 📝 Commits (1) - [`edc637b`](https://github.com/cloudflare/vinext/commit/edc637b071631b62fa2a8eb2c9b4442ce75833f8) fix: percent-encode X-Vinext-Params to allow non-ASCII route params (#676) ### 📊 Changes **3 files changed** (+26 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/app-browser-entry.ts` (+2 -2) 📝 `packages/vinext/src/server/app-page-response.ts` (+3 -1) 📝 `tests/app-page-response.test.ts` (+21 -1) </details> ### 📄 Description ## Summary - `buildAppPageRscResponse` was calling `Headers.set("X-Vinext-Params", JSON.stringify(params))` with raw Unicode characters in the value - The Fetch spec requires header values to be ByteStrings (each char ≤ U+00FF), so non-ASCII params (Korean, Japanese, etc.) caused a `TypeError: Cannot convert argument to a ByteString` - Only RSC/client-side navigation was affected — direct SSR requests (`buildAppPageHtmlResponse`) never set this header ## Fix - Encode with `encodeURIComponent` when setting `X-Vinext-Params` in `app-page-response.ts` - Decode with `decodeURIComponent` in both read sites in `app-browser-entry.ts` (initial hydration and client-side navigation) ## Test Added a unit test to `tests/app-page-response.test.ts` that verifies: 1. The header value is ASCII-safe after encoding 2. The params round-trip correctly through encode/decode Closes #676 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>