@uniweb/core 0.8.4 → 0.8.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/core",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "description": "Core classes for the Uniweb platform - Uniweb, Website, Page, Block",
   "type": "module",
   "exports": {
@@ -35,8 +35,8 @@
     "vitest": "^4.1.7"
   },
   "dependencies": {
-    "@uniweb/theming": "^0.1.15",
-    "@uniweb/semantic-parser": "^1.2.1"
+    "@uniweb/semantic-parser": "^1.2.2",
+    "@uniweb/theming": "^0.1.15"
   },
   "scripts": {
     "test": "vitest run"

package/src/route-match.js

@@ -100,6 +100,35 @@ export function routePatternToRegex(pattern) {
   return { regex: new RegExp(`^${source}$`), paramNames }
 }
 
+/**
+ * Decode a value that arrived from a URL, falling back to the raw input.
+ *
+ * Guarded rather than bare, for two independent reasons:
+ *
+ * A `%` that is not an escape is legitimate content — `/100%-Guide` authored by
+ * hand, or a value that has already been decoded once — and `decodeURIComponent`
+ * throws `URIError` on those. Falling back to the input keeps such a route
+ * matching exactly as well as it did before.
+ *
+ * And the input is attacker-controlled: `/blog/%zz` is a URL anyone can paste or
+ * link. This module is called by hosts that resolve a path to a page *per
+ * request*, where a throw out of the matcher is a visitor-triggerable 500 rather
+ * than a client-side error. A malformed escape is not a reason to lose an
+ * otherwise-good match, so the fallback is the raw capture rather than a miss —
+ * a route miss would turn a typo'd escape into a 404 on a page that exists.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function decodeRouteValue(value) {
+  if (typeof value !== 'string' || !value.includes('%')) return value
+  try {
+    return decodeURIComponent(value)
+  } catch {
+    return value
+  }
+}
+
 /**
  * Match a concrete path against a route pattern.
  *
@@ -109,8 +138,9 @@ export function routePatternToRegex(pattern) {
  * matchDynamicRoute('/blog/:slug', '/blog/')         // → null  (a param is non-empty)
  * ```
  *
- * Captured values are `decodeURIComponent`-ed, so a path carries percent
- * encoding and the param does not.
+ * Captured values are decoded, so a path carries percent encoding and the param
+ * does not. A malformed escape falls back to the raw capture rather than
+ * throwing — see `decodeRouteValue`. This function does not throw.
  *
  * @param {string} pattern - Route pattern with `:param` placeholders
  * @param {string} path - Concrete path to match
@@ -123,7 +153,7 @@ export function matchDynamicRoute(pattern, path) {
 
   const params = {}
   paramNames.forEach((name, i) => {
-    params[name] = decodeURIComponent(match[i + 1])
+    params[name] = decodeRouteValue(match[i + 1])
   })
   return { params }
 }

package/src/website.js

@@ -11,7 +11,7 @@ import FetcherDispatcher from './fetcher-dispatcher.js'
 import ObservableState from './observable-state.js'
 import { normalizeSeo } from './seo.js'
 import { resolveDefaultLocale } from './locale-config.js'
-import { matchDynamicRoute } from './route-match.js'
+import { matchDynamicRoute, decodeRouteValue } from './route-match.js'
 
 /**
  * Website — orchestration root for a single site instance.
@@ -321,16 +321,32 @@ export default class Website {
     if (!locale || locale === this.siteDefaultLocale) return displayRoute
     const entry = this._routeTranslations[locale]
     if (!entry) return displayRoute
+
+    // The caller hands us a route that came from a URL, and a browser
+    // percent-encodes everything outside the unreserved set — so a French slug
+    // arrives as `/Sites-Web/Th%C3%A8me-du-site-Web`. The translation map is
+    // built from site.yml, where it is authored as plain text. Decoding here
+    // rather than at each call site is deliberate: getPage(), normalizeRoute()
+    // and getLocaleUrl() all feed this, and a future caller would have to
+    // remember otherwise.
+    //
+    // Without it translateRoute() emits a URL this method cannot read back —
+    // every translated route carrying a non-ASCII character or an apostrophe
+    // resolved to nothing and rendered the 404 page, while the SAME route with
+    // an all-ASCII slug worked. The helper is shared with the captured-param
+    // decode in `route-match.js`, which needs the identical guard.
+    const route = decodeRouteValue(displayRoute)
+
     // Exact match
-    const canonical = entry.reverse.get(displayRoute)
+    const canonical = entry.reverse.get(route)
     if (canonical) return canonical
     // Prefix match
     for (const [trans, canon] of entry.reverse) {
-      if (displayRoute.startsWith(trans + '/')) {
-        return canon + displayRoute.slice(trans.length)
+      if (route.startsWith(trans + '/')) {
+        return canon + route.slice(trans.length)
       }
     }
-    return displayRoute
+    return route
   }
 
   /**
@@ -412,7 +428,10 @@ export default class Website {
     // Strip locale prefix if present (e.g., '/fr/about' → '/about')
     // Pages are stored with non-prefixed routes; the locale is a URL concern,
     // not a page identity concern.
-    let stripped = route
+    // Decode before ANY comparison: a published payload can hold translated
+    // display routes verbatim, so the direct match below needs the same plain
+    // text form the reverse-translate path does.
+    let stripped = decodeRouteValue(route)
     if (this.activeLocale && this.activeLocale !== this.defaultLocale) {
       const prefix = `/${this.activeLocale}`
       if (stripped === prefix || stripped === `${prefix}/`) {
@@ -440,10 +459,17 @@ export default class Website {
     }
 
     // Reverse-translate display route to canonical (e.g., '/acerca-de' → '/about')
-    stripped = this.reverseTranslateRoute(stripped)
-
-    // Normalize trailing slashes for consistent matching
-    // '/about/' and '/about' should match the same page
+    //
+    // Feed it the TRAILING-SLASH-NORMALIZED form. The translation map is keyed
+    // without a trailing slash, so `/acerca-de/` missed the exact lookup and
+    // fell through to the prefix branch, which rewrites only the FIRST segment
+    // — `/blogue/mi-articulo/` became `/blog/mi-articulo/`, leaving the child
+    // segment untranslated and pointing at no page. It looked like it worked
+    // for as long as every child slug happened to be identical in both locales.
+    stripped = this.reverseTranslateRoute(normalizedStripped)
+
+    // A translation VALUE may itself carry a trailing slash, so normalize again
+    // rather than assuming the input normalization covered it.
     const normalizedRoute = stripped === '/' ? '/' : stripped.replace(/\/$/, '')
 
     // Priority 1b: Exact match on canonical route