gina 0.4.5 → 0.4.6

package/framework/{v0.4.5 → v0.4.6}/core/controller/controller.render-swig.js

@@ -210,7 +210,9 @@ module.exports = async function render(userData, displayInspector, errOptions, d
     // Using server cache to cache compiledTemplates
     cache.from(self.serverInstance._cached);
 
-    cachePath       = self.serverInstance._cachePath;
+    // #TPL2 — cachePath (the layout-cache root) is derived IN-ROOT below, once
+    // localOptions is resolved; see the assignment before the layout-cache prime.
+    // Was: self.serverInstance._cachePath (a sibling, out-of-root tree).
 
     var err = null;
     // localOptions must be resolved before the isRenderingCustomError check below
@@ -408,6 +410,16 @@ module.exports = async function render(userData, displayInspector, errOptions, d
     var subFolder       = path.split(/\//g).slice(0, -1).join('/').replace(localOptions.template.html, '') || '';
     var hasSubFolder    = (subFolder && subFolder != '') ? true : false;
 
+    // #TPL2 — the processed-layout cache lives IN-ROOT, under the bundle templates
+    // root, so the {% extends %} rewrite below resolves inside the swig loader's
+    // basepath and swig-core's confinement (CVE-2023-25345) accepts it without an
+    // allowOutsideRoot opt-out. The leading-dot dir rides gina's existing
+    // dotfile-skip convention (the public/errors/forms scans in config.js), so the
+    // cache is never served as a static asset nor enumerated by template discovery.
+    // localOptions (not local.options) so the custom-error render path caches under
+    // its own template root.
+    cachePath = localOptions.template.html + '/.gina-layout-cache';
+
     if (
         !isWithoutLayout
         && !isRenderingCustomError
@@ -458,6 +470,16 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                         newLayoutDirObj.mkdirSync()
                     }
                     newLayoutDirObj = null;
+                    // #TPL2 — keep the in-root layout cache out of a bundle's git:
+                    // drop a self-ignoring .gitignore ('*') at the cache root so the
+                    // .gina-layout-cache tree never surfaces as untracked in a
+                    // consumer repo (the old out-of-root cache lived under the
+                    // project `cache/` dir consumers already ignore). Written once,
+                    // existsSync-guarded; best-effort.
+                    var _cacheIgnore = cachePath + '/.gitignore';
+                    if ( !fs.existsSync(_cacheIgnore) ) {
+                        try { fs.writeFileSync(_cacheIgnore, '*\n'); } catch (_giErr) { /* best effort */ }
+                    }
                     // [CVE-2023-25345] The layoutPath is extracted from the raw {% extends "..." %}
                     // directive in the template file. Without a boundary check, a template containing
                     // {% extends "../../../etc/passwd" %} would cause readFileSync to read arbitrary
@@ -973,7 +995,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                             + 'if(u&&u.environment&&u.environment.metrics){u.environment.metrics.weightBytes=' + _cacheWeightBytes + ';u.environment.metrics.serverMs=' + _cacheServerMsFinal + ';}'
                             + 'if(g&&g.environment&&g.environment.metrics){g.environment.metrics.weightBytes=' + _cacheWeightBytes + ';g.environment.metrics.serverMs=' + _cacheServerMsFinal + ';}'
                             + '}(window.__ginaData));</script>';
-                        htmlContent = htmlContent.replace(/<\/body>/i, _cachePatchScript + '</body>');
+                        htmlContent = htmlContent.replace(/<\/body>/i, function () { return _cachePatchScript + '</body>'; });
                     }
                 }
 
@@ -1299,11 +1321,28 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                 + '};});'
                 + '}(window));</script>\n';
 
+            // #TPL2 — inline the statusbar template body instead of {% include %}-ing
+            // it from the framework core dir. That include target is OUTSIDE the
+            // bundle templates root, which the swig loader now confines
+            // (CVE-2023-25345, allowOutsideRoot=false). statusbar.html is a leaf
+            // (only {% if page.cspNonce %} + {{ }} tags, no nested include/extends),
+            // so its body compiles identically when spliced into the layout in place
+            // of the include. Read per-render so dev edits hot-reload; this block is
+            // dev/debug-gated above, so there is no production read.
+            var _statusbarTpl = '';
+            try {
+                _statusbarTpl = await fs.promises.readFile(
+                    getPath('gina').core + '/asset/plugin/dist/vendor/gina/html/statusbar.html', 'utf8'
+                );
+            } catch (_sbErr) {
+                console.warn('[render] Inspector statusbar template unavailable: ' + (_sbErr.message || _sbErr));
+            }
+
             plugin = '\t'
                 + '{# Gina Inspector #}'
                 + __logsScript
                 + __gdScript
-                + '{%- include "'+ getPath('gina').core +'/asset/plugin/dist/vendor/gina/html/statusbar.html" -%}'// jshint ignore:line
+                + _statusbarTpl
                 + '{# END Gina Inspector #}'
             ;
 
@@ -1334,7 +1373,15 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                 localOptions.debugMode
                     && !/\{\# Gina Inspector \#\}/.test(layout)
             ) {
-                layout = layout.replace(/<\/body>/i, plugin + '\n\t</body>');
+                // $-safe splice. With a STRING replacement, String.prototype.replace expands
+                // dollar patterns: $` is the text BEFORE the match, $' the text AFTER it
+                // (also $&, $n). The inlined #TPL2 statusbar body literally contains both
+                // (a `$` followed by a backtick in a comment, and `$'` in a regex literal),
+                // so the old string form spliced the whole pre/post-</body> document INTO
+                // the statusbar <script> — a SyntaxError that killed the dev Inspector
+                // statusbar + launch link on any content-heavy page. A function replacer
+                // returns the text verbatim, with no dollar-pattern expansion.
+                layout = layout.replace(/<\/body>/i, function () { return plugin + '\n\t</body>'; });
             }
 
             // adding javascripts
@@ -1704,7 +1751,7 @@ module.exports = async function render(userData, displayInspector, errOptions, d
                             + 'if(u&&u.environment&&u.environment.metrics){u.environment.metrics.weightBytes=' + _weightBytesFinal + ';u.environment.metrics.serverMs=' + _serverMsFinal + ';}'
                             + 'if(g&&g.environment&&g.environment.metrics){g.environment.metrics.weightBytes=' + _weightBytesFinal + ';g.environment.metrics.serverMs=' + _serverMsFinal + ';}'
                             + '}(window.__ginaData));</script>';
-                        htmlContent = htmlContent.replace(/<\/body>/i, _patchScript + '</body>');
+                        htmlContent = htmlContent.replace(/<\/body>/i, function () { return _patchScript + '</body>'; });
                     }
                 }
 

package/framework/{v0.4.5 → v0.4.6}/core/gna.js

@@ -2001,6 +2001,30 @@ gna.run = run;
  */
 gna.encodeRFC5987ValueChars = encodeRFC5987ValueChars;
 
+/**
+ * Percent-decode a string, returning it unchanged on a malformed `%` escape
+ * (`decodeURIComponent` would throw `URIError`). Crash-safe decode for the
+ * server request path — see {@link safeDecodeURIComponent} in helpers/data (#B30).
+ *
+ * @param {string} str - Value to decode
+ * @returns {string} Decoded value, or the original string on URIError
+ * @example
+ *   safeDecodeURIComponent('100%'); // "100%" (decodeURIComponent would throw)
+ */
+gna.safeDecodeURIComponent = safeDecodeURIComponent;
+
+/**
+ * Whole-URI variant of {@link safeDecodeURIComponent} — wraps `decodeURI`
+ * (leaves `/ ? #` intact) and returns the input unchanged on a malformed `%`
+ * escape, so the routing / error paths cannot crash on a bad URL (#B30).
+ *
+ * @param {string} str - Value to decode
+ * @returns {string} Decoded value, or the original string on URIError
+ * @example
+ *   safeDecodeURI('/a%E0%A'); // "/a%E0%A" (decodeURI would throw)
+ */
+gna.safeDecodeURI = safeDecodeURI;
+
 /**
  * Parse a form/body string (`application/x-www-form-urlencoded` or JSON) into
  * a nested object. Recognises PHP-style `foo[bar][0]` keys.

package/framework/{v0.4.5 → v0.4.6}/core/plugins/lib/security-headers/csp/README.md

@@ -154,6 +154,40 @@ require('gina').plugins.Csp({
 });
 ```
 
+### Report-only-inert directives are omitted automatically
+
+The `sandbox` directive has **no effect** in a `Content-Security-Policy-Report-Only`
+header — it applies a document-level restriction rather than a load decision, so
+every engine ignores it there (the CSP Level 2 spec says it outright: *"The
+sandbox directive will be ignored when monitoring a policy"*) and logs
+*"Ignoring sandbox directive when delivered in a report-only policy"*. When `reportOnly: true`, the plugin therefore **omits**
+`sandbox` from the emitted header and logs one line at startup naming what was
+dropped. The omission is functionally identical (the directive does nothing in
+report-only) and keeps the browser console clean. `sandbox` remains in your
+configured `directives`, so an enforcing factory (`reportOnly: false`) built from
+the same config still emits it — you can keep **one directive set across both
+modes** without remove-then-re-add churn.
+
+`frame-ancestors` is **not** omitted — its report-only behaviour is
+**engine-divergent**: the CSP3 spec, Firefox (Gecko) and Chrome (Blink) evaluate
+it and send violation reports without enforcing, while Safari (WebKit) ignores
+it, logs *"The Content Security Policy directive 'frame-ancestors' is ignored
+when delivered in a report-only policy"* and sends no report (WebKit retains the
+CSP Level 2 rule — *"The frame-ancestors directive MUST be ignored when
+monitoring a policy"* — which CSP Level 3 dropped; CSP3 only restricts `<meta>`
+delivery, which a report-only policy never uses). The plugin keeps it so the
+observation phase still reports on Chrome and Firefox. If you serve a
+WebKit-heavy audience and want a clean Safari console, leave `frame-ancestors`
+out of your report-only directive set — clickjacking protection stays enforced
+by `X-Frame-Options` and/or an enforcing-mode `frame-ancestors`. (Chrome caveat:
+frame-ancestors violation reports are delivered via `report-uri`; known Chromium
+bugs leave them undelivered via `report-to`.) A report-only policy whose every
+directive is report-only-inert (e.g. only `sandbox`) **throws at factory call
+time**, since it would report nothing.
+
+The omitted set is intentionally conservative — `sandbox` is the only directive
+confirmed ignored in report-only across all engines.
+
 ## Per-response CSP nonce (`useNonce`)
 
 Set `useNonce: true` to drop `'unsafe-inline'` from `script-src` without
@@ -217,6 +251,7 @@ console at runtime. Gina favours fail-fast.
 | Source-list directive array contains a non-string entry  | Factory throws with index in message                 |
 | All directives resolve to `false` (omitted)              | Factory throws — empty CSP is invalid                |
 | `reportOnly` is non-boolean                              | Factory throws                                       |
+| `reportOnly:true` with only report-only-inert directives | Factory throws — a report-only policy would report nothing |
 | Plugin not registered                                    | Header not emitted; browser applies no CSP           |
 | Header already set by an earlier middleware              | Existing value preserved (idempotent)                |
 | Response already sent (`res.headersSent === true`)       | Node's `setHeader` no-ops; request resumes           |

package/framework/{v0.4.5 → v0.4.6}/core/plugins/lib/security-headers/csp/src/main.js

@@ -78,6 +78,24 @@
  * useful for non-enforcing migration testing. The browser reports
  * violations but does not block any resources.
  *
+ * In report-only mode the plugin also OMITS directives that browsers ignore
+ * there (`REPORT_ONLY_IGNORED_DIRECTIVES` — currently just `sandbox`, which
+ * every engine ignores in report-only: it applies a restriction but produces
+ * no violation report and triggers a browser console warning). The omission
+ * is functionally identical (the directive does nothing in report-only) and
+ * silences that console warning; a one-time factory-time `console.warn`
+ * names what was dropped. The omitted directives remain in the configured
+ * set, so an enforcing factory built from the same config still emits them.
+ * `frame-ancestors` is NOT omitted — its report-only behaviour is
+ * engine-divergent: the CSP3 spec, Gecko and Blink evaluate it and send
+ * violation reports (without enforcing), while WebKit alone ignores it with
+ * a console warning and no report (it retains CSP2's rule that the directive
+ * MUST be ignored when monitoring, which CSP3 dropped). Keeping it preserves
+ * the observation-phase signal on Chrome + Firefox; WebKit-heavy consumers
+ * can leave it out of their own report-only directive set. A report-only
+ * policy whose every directive is inert (e.g. only `sandbox`) throws at
+ * factory call time.
+ *
  * Opens Phase 2 of the gina security-headers track (Phase 1 = HDR1-4 +
  * HDR7 shipped in 0.3.15-alpha). Single-header plugin shape — composes
  * cleanly under the future `SecurityHeaders` combined wrapper (#HDR15).
@@ -162,6 +180,52 @@ var HYBRID_DIRECTIVES = [
     'sandbox'
 ];
 
+/**
+ * Directives that browsers IGNORE when delivered in a
+ * `Content-Security-Policy-Report-Only` header. A report-only policy monitors
+ * and reports violations but enforces nothing; `sandbox` applies a
+ * document-level restriction that produces no reportable violation, so the
+ * browser drops it in report-only mode AND emits a console warning
+ * ("Ignoring sandbox directive when delivered in a report-only policy"). It
+ * therefore contributes browser-console noise and zero monitoring value, so
+ * the plugin omits it from a report-only header (see the `reportOnly` notes in
+ * the module docstring above).
+ *
+ * Deliberately conservative — `sandbox` is the only directive confirmed
+ * ignored in report-only across ALL engines: CSP2 spec text ("The sandbox
+ * directive will be ignored when monitoring a policy"), MDN's Report-Only
+ * page ("supports all Content-Security-Policy directives except sandbox,
+ * which is ignored"), Chromium's SupportedInReportOnly() (false for
+ * Sandbox), and WebKit's console warning. Intentionally NOT included:
+ *  - `frame-ancestors` — report-only behaviour is ENGINE-DIVERGENT. The CSP3
+ *    spec, Gecko and Blink evaluate it and send violation reports without
+ *    enforcing (Chromium's SupportedInReportOnly() is true for
+ *    FrameAncestors; the WPT report-only frame-ancestors test asserts the
+ *    report). WebKit alone ignores it, logs "The Content Security Policy
+ *    directive 'frame-ancestors' is ignored when delivered in a report-only
+ *    policy." and sends no report — it retains CSP2's "MUST be ignored when
+ *    monitoring a policy", which CSP3 dropped (CSP3 restricts only `<meta>`
+ *    delivery, which a report-only policy cannot use anyway). Omitting it
+ *    would discard the observation-phase signal on Chrome + Firefox;
+ *    consumers serving WebKit-heavy audiences that want a clean Safari
+ *    console can omit it from their own report-only directive set
+ *    (clickjacking stays enforced by X-Frame-Options and/or an enforcing
+ *    frame-ancestors regardless).
+ *  - `upgrade-insecure-requests` / `block-all-mixed-content` — not confirmed
+ *    inert across engines: Chromium ignores-and-warns
+ *    `upgrade-insecure-requests` in report-only but supports
+ *    `block-all-mixed-content` there, and Gecko/WebKit behaviour is
+ *    unverified; excluded under uncertainty (omitting a directive that may
+ *    still act/report would lose behaviour or signal). Expanding this list
+ *    requires an empirical per-engine check first.
+ *
+ * @constant
+ * @type {string[]}
+ */
+var REPORT_ONLY_IGNORED_DIRECTIVES = [
+    'sandbox'
+];
+
 
 /**
  * Read the active bundle's `settings.json > csp.*` block and return the
@@ -416,6 +480,32 @@ function buildHeaderValue(normalised, nonce, nonceTarget) {
 }
 
 
+/**
+ * Return a shallow copy of the normalised directive dict with the
+ * report-only-inert directives (`REPORT_ONLY_IGNORED_DIRECTIVES`) removed.
+ * Used only when `reportOnly` is true. Pure — never mutates the input, so the
+ * full configured set survives for an enforcing factory built from the same
+ * directives.
+ *
+ * @param {object} normalised — validated directive dict from resolveDirectives.
+ * @returns {object} a new dict without the report-only-ignored directives.
+ * @inner
+ * @private
+ */
+function stripReportOnlyIgnored(normalised) {
+    var out  = {};
+    var keys = Object.keys(normalised);
+    for (var i = 0; i < keys.length; i++) {
+        var name = keys[i];
+        if (REPORT_ONLY_IGNORED_DIRECTIVES.indexOf(name) !== -1) {
+            continue;
+        }
+        out[name] = normalised[name];
+    }
+    return out;
+}
+
+
 /**
  * Coerce `useNonce` to a strict boolean. Defaults to `false` (static header,
  * no per-request nonce). `true` opts into per-response nonce generation.
@@ -538,10 +628,52 @@ function Csp(opts) {
     var reportOnly  = resolveReportOnly(merged.reportOnly);
     var useNonce    = resolveUseNonce(merged.useNonce);
 
+    // Report-only mode: drop directives browsers ignore in a report-only
+    // header (REPORT_ONLY_IGNORED_DIRECTIVES — currently `sandbox`). They apply
+    // no restriction and emit no violation report there, so omitting them is
+    // functionally identical while silencing the browser console warning. They
+    // survive in `directives`, so an enforcing factory built from the same
+    // config still emits them.
+    var emitDirectives = directives;
+    if (reportOnly) {
+        emitDirectives = stripReportOnlyIgnored(directives);
+        var dropped = Object.keys(directives).filter(function (d) {
+            return !Object.prototype.hasOwnProperty.call(emitDirectives, d);
+        });
+        if (Object.keys(emitDirectives).length === 0) {
+            // Mirrors the all-omitted throw in resolveDirectives: an empty CSP
+            // is invalid, and a report-only policy made entirely of inert
+            // directives reports nothing — surface it at factory (boot) time.
+            throw new Error(
+                '[gina.plugins.Csp] reportOnly:true but every configured directive is '
+                + 'ignored by browsers in report-only mode (' + dropped.join(', ') + '). '
+                + 'A report-only policy needs at least one directive that produces '
+                + 'violation reports (e.g. script-src / default-src / frame-ancestors). '
+                + 'sandbox applies a restriction but reports nothing, so it is dropped '
+                + 'in report-only mode.'
+            );
+        }
+        if (dropped.length > 0) {
+            // Transparency: the emitted header diverges from the configured
+            // directives. One line at factory (boot) time — per call, no
+            // module-level latch — so the operator knows why a configured
+            // directive is absent from the wire.
+            console.warn(
+                '[gina.plugins.Csp] reportOnly:true — omitting directive(s) ignored by '
+                + 'browsers in report-only mode: ' + dropped.join(', ') + '. They apply no '
+                + 'restriction and emit a browser console warning in report-only mode; they '
+                + 'are included automatically when reportOnly is false.'
+            );
+        }
+    }
+
     var headerName  = reportOnly ? HEADER_NAME_REPORT_ONLY : HEADER_NAME;
     // Static value — reused on every response when useNonce is off.
-    var headerValue = buildHeaderValue(directives);
+    var headerValue = buildHeaderValue(emitDirectives);
     // Fail-fast at factory time: a nonce needs a script-governing directive.
+    // Resolved from `directives` (not emitDirectives) — the nonce target is
+    // always script-src/default-src, which are never report-only-stripped, so
+    // the two sets agree; the middleware still serialises emitDirectives.
     var nonceTarget = useNonce ? resolveNonceTarget(directives) : null;
 
     return function ginaCsp(req, res, next) {
@@ -553,7 +685,7 @@ function Csp(opts) {
             // render delegates can mirror it onto framework inline <script>s.
             var nonce = crypto.randomBytes(NONCE_BYTES).toString('base64');
             if (req) { req._ginaCspNonce = nonce; }
-            res.setHeader(headerName, buildHeaderValue(directives, nonce, nonceTarget));
+            res.setHeader(headerName, buildHeaderValue(emitDirectives, nonce, nonceTarget));
         } else {
             res.setHeader(headerName, headerValue);
         }
@@ -578,5 +710,7 @@ Csp._resolveReportOnly        = resolveReportOnly;
 Csp._resolveUseNonce          = resolveUseNonce;
 Csp._resolveNonceTarget       = resolveNonceTarget;
 Csp._buildHeaderValue         = buildHeaderValue;
+Csp._REPORT_ONLY_IGNORED_DIRECTIVES = REPORT_ONLY_IGNORED_DIRECTIVES;
+Csp._stripReportOnlyIgnored         = stripReportOnlyIgnored;
 
 module.exports = Csp;

package/framework/{v0.4.5 → v0.4.6}/core/plugins/lib/storage/package.json

@@ -13,9 +13,6 @@
     "node": ">=0.10.22"
   },
   "main": "src/main",
-  "scripts": {
-    "test": "nodeunit test"
-  },
   "license": "MIT",
   "readmeFilename": "README.md"
 }

package/framework/{v0.4.5 → v0.4.6}/core/plugins/lib/validator/package.json

@@ -17,9 +17,6 @@
     "node": ">=0.10.22"
   },
   "main": "src/main",
-  "scripts": {
-    "test": "nodeunit test"
-  },
   "license": "MIT",
   "readmeFilename": "README.md"
 }

package/framework/{v0.4.5 → v0.4.6}/core/plugins/lib/validator/src/main.js

@@ -1969,8 +1969,18 @@ function ValidatorPlugin(rules, data, formId) {
                 }
                 //console.debug('sending -> ', data);
                 if (!hasBinaries) {
-                    if (typeof (enctype) != 'undefined' && enctype != null && enctype != '') {
-                        xhr.setRequestHeader('Content-Type', enctype);
+                    // #FORMCT — the non-binary body is JSON (JSON.stringify'd above). Honor an
+                    // EXPLICIT form `enctype` if set; otherwise send application/json — NOT the
+                    // urlencoded default — or the server url-decodes the JSON body ('+' -> space,
+                    // decodeURIComponent) and corrupts values such as email "+aliases".
+                    var explicitEnctype = $target.getAttribute('enctype');
+                    var sendContentType = (explicitEnctype && explicitEnctype != '')
+                        ? explicitEnctype
+                        : ( (typeof(data) == 'string' && /^[\[{]/.test(data.trim()))
+                            ? 'application/json; charset=UTF-8'
+                            : enctype );
+                    if (typeof (sendContentType) != 'undefined' && sendContentType != null && sendContentType != '') {
+                        xhr.setRequestHeader('Content-Type', sendContentType);
                     }
                     xhr.send(data)
                 }
@@ -2346,8 +2356,11 @@ function ValidatorPlugin(rules, data, formId) {
                             method: method,
                             isSynchrone: isSynchrone,
                             headers : {
-                                // to upload, use `multipart/form-data` for `enctype`
-                                'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
+                                // #FORMCT — the body sent below is JSON (JSON.stringify({ files })).
+                                // Send application/json — NOT the urlencoded default — or the server
+                                // url-decodes the JSON body ('+' -> space, decodeURIComponent) and
+                                // corrupts '+'/'%' in removed-file keys.
+                                'Content-Type': 'application/json; charset=UTF-8',
                                 // cross domain is enabled by default, but you need to setup `Access-Control-Allow-Origin`
                                 'X-Requested-With': 'XMLHttpRequest' // in case of cross domain origin
                             }

package/framework/{v0.4.5 → v0.4.6}/core/server.isaac.js

@@ -1615,7 +1615,7 @@ function ServerEngineClass(options) {
                                 else if (a[1] && (a[1].indexOf('+') > -1 || a[1].indexOf('%') > -1)) {
                                     // #B17: '+' → space per WHATWG URL form-urlencoded parser; must run before decodeURIComponent (which does NOT decode '+').
                                     if (a[1].indexOf('+') > -1) a[1] = a[1].replace(/\+/g, ' ');
-                                    if (a[1].indexOf('%') > -1) a[1] = decodeURIComponent(a[1]);
+                                    if (a[1].indexOf('%') > -1) a[1] = safeDecodeURIComponent(a[1]); // #B30: malformed-%-safe (raw fallback) — an unguarded decodeURIComponent here crashes the bundle
                                 }
 
                                 if (a[1] && typeof a[1] === 'string' && (a[1].charAt(0) === '{' || a[1].charAt(0) === '[') ) {
@@ -1639,7 +1639,7 @@ function ServerEngineClass(options) {
                             else if (a[1] && (a[1].indexOf('+') > -1 || a[1].indexOf('%') > -1)) {
                                 // #B17: '+' → space per WHATWG URL form-urlencoded parser; must run before decodeURIComponent (which does NOT decode '+').
                                 if (a[1].indexOf('+') > -1) a[1] = a[1].replace(/\+/g, ' ');
-                                if (a[1].indexOf('%') > -1) a[1] = decodeURIComponent(a[1]);
+                                if (a[1].indexOf('%') > -1) a[1] = safeDecodeURIComponent(a[1]); // #B30: malformed-%-safe (raw fallback) — an unguarded decodeURIComponent here crashes the bundle
                             }
 
                             request.query[ a[0] ] = a[1]