cloudflare / cloudflare/chanfana

Path parameters not unescaped correctly

Open
#88 4 comments 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
766
Forks
70
Avg merge
25m
Merged PRs (30d)
4

Description

Not really sure if it's a bug with `itty-router` or `itty-router-openapi` but it affects `itty-router-openapi` users.

Given an endpoint like this (using `.original` for simplicity):

```ts
router.original.get(
"/something/:id",
(request) => new Response(`id: ${request.params.id}`)
);
```

Making a query to `/something/user%3A1234` returns the following response: `id: user%3A1234`. While it should be `id: user:1234`.

Just to make sure my assumption is correct I made an express application with a similar endpoint and the response is correct (`id: user:1234`):

```ts
app.get("/something/:id", (req, res) => {
res.send(`id: ${req.params.id}`);
});
```

My workaround is to decode the full URL before passing it to the library. Like this:

```ts
export async function handleRequest(
request: Request,
env: Bindings,
context: ExecutionContext
) {
const req = new Request(decodeURIComponent(request.url), request);
return router.handle(req, env, context);
}
```

Not sure if it's the best approach.

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with router.original.get("/something/:id", ...) and a request to /something/user%3A1234, then trace how router.handle populates request.params.id. Compare the result with the expected decoded value and the reported workaround. Done means encoded path parameters are decoded for itty-router-openapi users without requiring callers to decode the full URL.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.