@uniweb/core 0.8.5 → 0.8.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/core",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Core classes for the Uniweb platform - Uniweb, Website, Page, Block",
   "type": "module",
   "exports": {
@@ -35,8 +35,8 @@
     "vitest": "^4.1.7"
   },
   "dependencies": {
-    "@uniweb/theming": "^0.1.15",
-    "@uniweb/semantic-parser": "^1.2.2"
+    "@uniweb/semantic-parser": "^1.2.2",
+    "@uniweb/theming": "^0.1.15"
   },
   "scripts": {
     "test": "vitest run"

package/src/route-match.js

@@ -100,6 +100,35 @@ export function routePatternToRegex(pattern) {
   return { regex: new RegExp(`^${source}$`), paramNames }
 }
 
+/**
+ * Decode a value that arrived from a URL, falling back to the raw input.
+ *
+ * Guarded rather than bare, for two independent reasons:
+ *
+ * A `%` that is not an escape is legitimate content — `/100%-Guide` authored by
+ * hand, or a value that has already been decoded once — and `decodeURIComponent`
+ * throws `URIError` on those. Falling back to the input keeps such a route
+ * matching exactly as well as it did before.
+ *
+ * And the input is attacker-controlled: `/blog/%zz` is a URL anyone can paste or
+ * link. This module is called by hosts that resolve a path to a page *per
+ * request*, where a throw out of the matcher is a visitor-triggerable 500 rather
+ * than a client-side error. A malformed escape is not a reason to lose an
+ * otherwise-good match, so the fallback is the raw capture rather than a miss —
+ * a route miss would turn a typo'd escape into a 404 on a page that exists.
+ *
+ * @param {string} value
+ * @returns {string}
+ */
+export function decodeRouteValue(value) {
+  if (typeof value !== 'string' || !value.includes('%')) return value
+  try {
+    return decodeURIComponent(value)
+  } catch {
+    return value
+  }
+}
+
 /**
  * Match a concrete path against a route pattern.
  *
@@ -109,8 +138,9 @@ export function routePatternToRegex(pattern) {
  * matchDynamicRoute('/blog/:slug', '/blog/')         // → null  (a param is non-empty)
  * ```
  *
- * Captured values are `decodeURIComponent`-ed, so a path carries percent
- * encoding and the param does not.
+ * Captured values are decoded, so a path carries percent encoding and the param
+ * does not. A malformed escape falls back to the raw capture rather than
+ * throwing — see `decodeRouteValue`. This function does not throw.
  *
  * @param {string} pattern - Route pattern with `:param` placeholders
  * @param {string} path - Concrete path to match
@@ -123,7 +153,7 @@ export function matchDynamicRoute(pattern, path) {
 
   const params = {}
   paramNames.forEach((name, i) => {
-    params[name] = decodeURIComponent(match[i + 1])
+    params[name] = decodeRouteValue(match[i + 1])
   })
   return { params }
 }

package/src/website.js

@@ -11,28 +11,7 @@ import FetcherDispatcher from './fetcher-dispatcher.js'
 import ObservableState from './observable-state.js'
 import { normalizeSeo } from './seo.js'
 import { resolveDefaultLocale } from './locale-config.js'
-import { matchDynamicRoute } from './route-match.js'
-
-/**
- * Decode a route that arrived from a URL.
- *
- * `location.pathname` is percent-encoded per RFC 3986, while page routes and
- * `i18n.routeTranslations` are authored as plain text — so the two are only
- * comparable once the incoming side is decoded.
- *
- * Guarded rather than bare: a route may legitimately contain a `%` that is not
- * an escape (`/100%-Guide` authored by hand, or a value already decoded once),
- * and `decodeURIComponent` throws `URIError` on those. Falling back to the input
- * keeps a malformed route matching exactly as well as it did before.
- */
-function decodeRoute(route) {
-  if (typeof route !== 'string' || !route.includes('%')) return route
-  try {
-    return decodeURIComponent(route)
-  } catch {
-    return route
-  }
-}
+import { matchDynamicRoute, decodeRouteValue } from './route-match.js'
 
 /**
  * Website — orchestration root for a single site instance.
@@ -354,9 +333,9 @@ export default class Website {
     // Without it translateRoute() emits a URL this method cannot read back —
     // every translated route carrying a non-ASCII character or an apostrophe
     // resolved to nothing and rendered the 404 page, while the SAME route with
-    // an all-ASCII slug worked. `route-match.js` already decodes captured
-    // params for exactly this reason.
-    const route = decodeRoute(displayRoute)
+    // an all-ASCII slug worked. The helper is shared with the captured-param
+    // decode in `route-match.js`, which needs the identical guard.
+    const route = decodeRouteValue(displayRoute)
 
     // Exact match
     const canonical = entry.reverse.get(route)
@@ -452,7 +431,7 @@ export default class Website {
     // Decode before ANY comparison: a published payload can hold translated
     // display routes verbatim, so the direct match below needs the same plain
     // text form the reverse-translate path does.
-    let stripped = decodeRoute(route)
+    let stripped = decodeRouteValue(route)
     if (this.activeLocale && this.activeLocale !== this.defaultLocale) {
       const prefix = `/${this.activeLocale}`
       if (stripped === prefix || stripped === `${prefix}/`) {