fix(shared): keep valid escapes decoded when percent-decoding malformed input

[dinwwwh]

getFilenameFromContentDisposition now decodes the valid escapes in a malformed filename*. Before, safeDecodeURIComponent returned the whole input unchanged as soon as decodeURIComponent threw. So one bad escape left every other escape encoded: filename*=utf-8''%E4%B8%AD%ZZ.txt came back as %E4%B8%AD%ZZ.txt instead of 中%ZZ.txt.

Fixes

• When decoding the whole value throws, each run of %XX escapes is decoded separately. Runs that still fail are kept as-is. This is the same fallback as Hono's tryDecode.
• A run that is not valid UTF-8 as a whole stays encoded: %E4%B8%AD%FF is unchanged.
• safeDecodeURIComponent no longer returns malformed input unchanged. Its only caller in this repo is getFilenameFromContentDisposition. Code outside the repo that uses @standard-server/shared and relies on the old behaviour will now get partly decoded output.

Performance

• Valid input still goes through a single decodeURIComponent call, so there is no extra cost.
• Malformed input pays for the fallback, with one caught error per run that fails to decode. %E4%B8%AD%ZZ.txt takes about 3.8 µs. A crafted 16 KB Content-Disposition header made of thousands of invalid runs takes about 13 ms, compared with about 2 µs before.

Testing

• The safeDecodeURIComponent tests cover:
  • a trailing %, a truncated sequence and a non-hex escape;
  • lowercase hex, and an invalid run next to a valid one;
  • a run that is not valid UTF-8 as a whole;
  • no double decoding: %2541%ZZ gives %41%ZZ.
• The getFilenameFromContentDisposition tests cover a malformed filename* with and without a charset prefix.
• The new tests fail against main. vitest run (1311 passed), eslint and the repo-wide type check are clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_014w3GkqAVAgbiC1X6JcXr4e

[pkg-pr-new]

• @standard-server/hono-node-playground
• @standard-server/node-http-playground

@standard-server/aws-lambda

npm i https://pkg.pr.new/@standard-server/aws-lambda@133

@standard-server/core

npm i https://pkg.pr.new/@standard-server/core@133

@standard-server/fastify

npm i https://pkg.pr.new/@standard-server/fastify@133

@standard-server/fetch

npm i https://pkg.pr.new/@standard-server/fetch@133

@standard-server/node

npm i https://pkg.pr.new/@standard-server/node@133

@standard-server/peer

npm i https://pkg.pr.new/@standard-server/peer@133

@standard-server/shared

npm i https://pkg.pr.new/@standard-server/shared@133

commit: 466e4ce

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 108 skipped benchmarks¹

---

_{Comparing claude/fervent-dijkstra-sx43sq (466e4ce) with main (75cffb5)}

Footnotes

1. 108 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[pullfrog]

✅ No new issues found.

Reviewed changes — the partial-decode rework of safeDecodeURIComponent and its test coverage.

• Partial-decode fallback (packages/shared/src/uri.ts) — when the whole-value decodeURIComponent throws, maximal contiguous runs of %XX escapes are decoded independently, and a run that still throws is kept verbatim; the whole-value fast path keeps valid input byte-identical to before.
• Unit coverage (packages/shared/src/uri.test.ts) — headline case changed from "unchanged" to the decoded result, plus mixed valid/invalid, invalid-UTF-8, poisoned-run, and no-double-decode (%2541%ZZ → %41%ZZ) cases.
• Content-Disposition coverage (packages/core/src/utils.test.ts) — two filename* cases pin the new behavior at the only downstream caller.

Verified locally: pnpm exec vitest run packages/shared packages/core passes (197 tests), eslint is clean on the changed files, and the new uri.test.ts case fails against the base uri.ts (so the regression test is discriminating). The run-level (non-greedy) decode choice — an invalid byte poisons its whole hex run — is conservative and intentional, and partial decoding exposes no bytes (%00, %2f, CRLF) that a fully valid encoding could not already produce.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (default — pick a model for stronger reviews) ｜ 𝕏}