fix(shared): keep valid escapes decoded when percent-decoding malformed input

packages/core/src/utils.test.ts

@@ -108,6 +108,10 @@ it('getFilenameFromContentDisposition', () => {
   expect(getFilenameFromContentDisposition('inline; x="; filename*=utf-8\'\'evil.exe')).toEqual(undefined)
   expect(getFilenameFromContentDisposition('inline; filename="a\\"')).toEqual(undefined)
 
+  // malformed escapes in filename* are kept as-is, the valid ones are still decoded
+  expect(getFilenameFromContentDisposition('attachment; filename*=utf-8\'\'%E4%B8%AD%ZZ.txt')).toEqual('中%ZZ.txt')
+  expect(getFilenameFromContentDisposition('inline; filename*=%E2%82%AC%.txt')).toEqual('€%.txt')
+
   // quoted filename* is tolerated
   expect(getFilenameFromContentDisposition('attachment; filename*="utf-8\'\'%E2%82%AC.txt"')).toEqual('€.txt')
 

packages/shared/src/uri.test.ts

@@ -28,9 +28,15 @@ describe('safeDecodeURIComponent', () => {
     expect(safeDecodeURIComponent('')).toBe('')
   })
 
-  it('returns malformed input unchanged instead of throwing', () => {
-    expect(safeDecodeURIComponent('invalid%20value%')).toBe('invalid%20value%')
+  it('keeps malformed escapes as-is and still decodes the valid ones instead of throwing', () => {
+    expect(safeDecodeURIComponent('invalid%20value%')).toBe('invalid value%')
     expect(safeDecodeURIComponent('%E0%A4%A')).toBe('%E0%A4%A') // Invalid UTF-8 sequence
     expect(safeDecodeURIComponent('%ZZ')).toBe('%ZZ')
+    expect(safeDecodeURIComponent('%ZZ%e4%b8%ad%')).toBe('%ZZ中%')
+    expect(safeDecodeURIComponent('%FF-%E2%82%AC')).toBe('%FF-€')
+    // a run of escapes that is not valid UTF-8 is kept as a whole
+    expect(safeDecodeURIComponent('%E4%B8%AD%FF%')).toBe('%E4%B8%AD%FF%')
+    // decoded output is not decoded again
+    expect(safeDecodeURIComponent('%2541%ZZ')).toBe('%41%ZZ')
   })
 })

packages/shared/src/uri.ts

@@ -1,4 +1,5 @@
 const LONE_SURROGATE_REGEX = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g
+const PERCENT_ESCAPES_REGEX = /(?:%[0-9A-F]{2})+/gi
 
 /**
  * `encodeURIComponent` that never throws, lone surrogates become U+FFFD.
@@ -15,7 +16,7 @@ export function safeEncodeURIComponent(value: string): string {
 }
 
 /**
- * `decodeURIComponent` that never throws, malformed input is returned unchanged.
+ * `decodeURIComponent` that never throws, runs of `%XX` escapes that fail to decode are kept as-is.
  */
 export function safeDecodeURIComponent(value: string): string {
   if (!value.includes('%')) {
@@ -27,6 +28,14 @@ export function safeDecodeURIComponent(value: string): string {
     return decodeURIComponent(value)
   }
   catch {
-    return value
+    return value.replace(PERCENT_ESCAPES_REGEX, (escapes) => {
+      try {
+        // eslint-disable-next-line no-restricted-globals
+        return decodeURIComponent(escapes)
+      }
+      catch {
+        return escapes
+      }
+    })
   }
 }