cloudflare / cloudflare/chanfana
Path parameters not unescaped correctly
- Dominant language
- TypeScript
- Stars
- 766
- Forks
- 70
- Avg merge
- 25m
- Merged PRs (30d)
- 4
Description
Not really sure if it's a bug with `itty-router` or `itty-router-openapi` but it affects `itty-router-openapi` users.
Given an endpoint like this (using `.original` for simplicity):
```ts
router.original.get(
"/something/:id",
(request) => new Response(`id: ${request.params.id}`)
);
```
Making a query to `/something/user%3A1234` returns the following response: `id: user%3A1234`. While it should be `id: user:1234`.
Just to make sure my assumption is correct I made an express application with a similar endpoint and the response is correct (`id: user:1234`):
```ts
app.get("/something/:id", (req, res) => {
res.send(`id: ${req.params.id}`);
});
```
My workaround is to decode the full URL before passing it to the library. Like this:
```ts
export async function handleRequest(
request: Request,
env: Bindings,
context: ExecutionContext
) {
const req = new Request(decodeURIComponent(request.url), request);
return router.handle(req, env, context);
}
```
Not sure if it's the best approach.
Contributor guide
Research direction
Reproduce the issue with router.original.get("/something/:id", ...) and a request to /something/user%3A1234, then trace how router.handle populates request.params.id. Compare the result with the expected decoded value and the reported workaround. Done means encoded path parameters are decoded for itty-router-openapi users without requiring callers to decode the full URL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100