[PR #697] [MERGED] fix: use segment-wise pathname decoding in App->Pages Router fallback #779

New issue

Closed

opened 2026-05-06 13:10:04 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:10:04 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/697
Author: @southpolesteve
Created: 3/27/2026
Status: ✅ Merged
Merged: 3/27/2026
Merged by: @southpolesteve

Base: main ← Head: fix/segment-wise-decode-pages-fallback

📝 Commits (1)

1295500 fix: use segment-wise pathname decoding in App->Pages fallback

📊 Changes

4 files changed (+138 additions, -1 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+10 -1)
📝 packages/vinext/src/server/normalize-path.ts (+39 -0)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+6 -0)
📝 tests/shims.test.ts (+83 -0)

📄 Description

Summary

The App Router to Pages Router fallback now uses segment-wise pathname decoding instead of decodeURIComponent, preserving encoded path delimiters like %2F.

Problem

The fallback path used decodeURIComponent(url.pathname), which decoded %2F to /, changing the path structure. A request to /security/admin%2Fpanel would skip a middleware matcher for /security/admin/:path* (since %2F is not a segment delimiter in the encoded form), but the Pages fallback would decode it to /security/admin/panel and serve the protected page.

Fix

Replace decodeURIComponent with decodePathParams(), which:

Splits the pathname by /
Decodes each segment individually with decodeURIComponent
Re-encodes path delimiters (/, #, ?) via escapePathDelimiters
Rejoins with /

This decodes non-ASCII characters within segments (e.g., %C3%A9 -> e) but preserves the path structure (%2F stays as %2F).

Both utilities are ported from Next.js:

Tests

escapePathDelimiters: 4 tests (slash, hash, question mark, encoded forms, non-delimiters)
decodePathParams: 8 tests (non-ASCII decode, %2F preservation, %23/%3F preservation, mixed paths, malformed encoding, root path)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/697 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 3/27/2026 **Status:** ✅ Merged **Merged:** 3/27/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/segment-wise-decode-pages-fallback` --- ### 📝 Commits (1) - [`1295500`](https://github.com/cloudflare/vinext/commit/12955005292cf3a9dd620011cfc5ad2da69f0edf) fix: use segment-wise pathname decoding in App->Pages fallback ### 📊 Changes **4 files changed** (+138 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+10 -1) 📝 `packages/vinext/src/server/normalize-path.ts` (+39 -0) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+6 -0) 📝 `tests/shims.test.ts` (+83 -0) </details> ### 📄 Description ## Summary The App Router to Pages Router fallback now uses segment-wise pathname decoding instead of `decodeURIComponent`, preserving encoded path delimiters like `%2F`. ## Problem The fallback path used `decodeURIComponent(url.pathname)`, which decoded `%2F` to `/`, changing the path structure. A request to `/security/admin%2Fpanel` would skip a middleware matcher for `/security/admin/:path*` (since `%2F` is not a segment delimiter in the encoded form), but the Pages fallback would decode it to `/security/admin/panel` and serve the protected page. ## Fix Replace `decodeURIComponent` with `decodePathParams()`, which: 1. Splits the pathname by `/` 2. Decodes each segment individually with `decodeURIComponent` 3. Re-encodes path delimiters (`/`, `#`, `?`) via `escapePathDelimiters` 4. Rejoins with `/` This decodes non-ASCII characters within segments (e.g., `%C3%A9` -> `e`) but preserves the path structure (`%2F` stays as `%2F`). Both utilities are ported from Next.js: - [`escapePathDelimiters`](https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts) - [`decodePathParams`](https://github.com/vercel/next.js/blob/canary/packages/next/src/server/lib/router-utils/decode-path-params.ts) ## Tests - `escapePathDelimiters`: 4 tests (slash, hash, question mark, encoded forms, non-delimiters) - `decodePathParams`: 8 tests (non-ASCII decode, %2F preservation, %23/%3F preservation, mixed paths, malformed encoding, root path) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>