fix(event): clone URL for pathname normalization instead of mutating shared _url

pi0 · claude · pi0 · commit a1cf066c5089 · 2026-07-03T22:17:40.000Z
The runtime-provided parsed URL (req._url) is shared with req.url and, on node, srvx syncs pathname mutations back into the raw request. The in-place percent-decode therefore destroyed the original wire encoding on node while web runtimes kept it, leaving no way to read the undecoded URL. Build a fresh FastURL when decoding changes the pathname so event.url is normalized on every runtime while req.url and the raw node req.url stay pristine. The clone (one URL parse) is only paid on pathnames whose decode is not an identity. closes #1432 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
diff --git a/src/event.ts b/src/event.ts
@@ -65,11 +65,16 @@ export class H3Event<
     this.app = app;
     // Parsed URL can be provided by srvx (node) and other runtimes
     const _url = (req as { _url?: URL })._url;
-    const url = _url && _url instanceof URL ? _url : new FastURL(req.url);
+    let url = _url && _url instanceof URL ? _url : new FastURL(req.url);
     // Normalize percent-encoded pathname to prevent middleware bypass
     if (url.pathname.includes("%")) {
       try {
-        url.pathname = decodePathname(url.pathname);
+        const pathname = decodePathname(url.pathname);
+        if (pathname !== url.pathname) {
+          // Clone instead of mutating: the parsed URL is shared with the
+          // runtime, and req.url must keep the original wire encoding (#1432)
+          url = new FastURL(`${url.protocol}//${url.host}${pathname}${url.search}`);
+        }
       } catch {
         // Malformed percent-encoding (e.g. `/foo%`, `/%ZZ`): flag for a 400
         // response and keep the raw pathname so route matching and middleware
diff --git a/test/bench/bundle.test.ts b/test/bench/bundle.test.ts
@@ -34,8 +34,8 @@ describe("benchmark", () => {
     if (process.env.DEBUG) {
       console.log(`Bundle size (H3Core): ${bundle.bytes} (gzip: ${bundle.gzipSize})`);
     }
-    expect(bundle.bytes).toBeLessThanOrEqual(6600); // <6.6kb
-    expect(bundle.gzipSize).toBeLessThanOrEqual(2650); // <2.65kb
+    expect(bundle.bytes).toBeLessThanOrEqual(6650); // <6.65kb
+    expect(bundle.gzipSize).toBeLessThanOrEqual(2680); // <2.68kb
   });
 
   it("bundle size (defineHandler)", async () => {
@@ -51,7 +51,7 @@ describe("benchmark", () => {
       console.log(`Bundle size (defineHandler): ${bundle.bytes} (gzip: ${bundle.gzipSize})`);
     }
     expect(bundle.bytes).toBeLessThanOrEqual(6200); // <6.2kb
-    expect(bundle.gzipSize).toBeLessThanOrEqual(2500); // <2.5kb
+    expect(bundle.gzipSize).toBeLessThanOrEqual(2520); // <2.52kb
   });
 });
 
diff --git a/test/event.test.ts b/test/event.test.ts
@@ -93,7 +93,7 @@ describeMatrix("event", (t, { it, expect }) => {
     expect(await result.text()).toBe("200");
   });
 
-  it("normalizes percent-encoded pathname and syncs the raw node url", async () => {
+  it("normalizes event.url without touching req.url on any runtime", async () => {
     t.app.all("/*", (event) => ({
       pathname: event.url.pathname,
       reqUrl: event.req.url,
@@ -102,15 +102,11 @@ describeMatrix("event", (t, { it, expect }) => {
     const res = await t.fetch("/h%65llo?q=%41");
     const body = await res.json();
     expect(body.pathname).toBe("/hello");
+    // req.url keeps the original wire encoding on every runtime (#1432)
+    expect(new URL(body.reqUrl).pathname).toBe("/h%65llo");
     if (t.target === "node") {
-      // srvx derives req.url from the shared _url, so the normalization
-      // shows through, and NodeRequestURL writes pathname mutations back
-      // to the raw Node request; the search string must stay untouched
-      expect(new URL(body.reqUrl).pathname).toBe("/hello");
-      expect(body.rawNodeUrl).toBe("/hello?q=%41");
+      expect(body.rawNodeUrl).toBe("/h%65llo?q=%41");
     } else {
-      // web Request.url is an immutable string and keeps the wire encoding
-      expect(new URL(body.reqUrl).pathname).toBe("/h%65llo");
       expect(body.rawNodeUrl).toBe(null);
     }
   });
diff --git a/test/unit/event.test.ts b/test/unit/event.test.ts
@@ -4,12 +4,30 @@ import { H3Event } from "../../src/event.ts";
 import { decodePathname } from "../../src/utils/internal/path.ts";
 
 describe("H3Event URL normalization", () => {
-  it("reuses the runtime-provided _url object in place", () => {
-    const req = new Request("http://localhost/h%65llo");
-    (req as any)._url = new FastURL("http://localhost/h%65llo");
+  it("reuses the runtime-provided _url when no decoding is needed", () => {
+    const req = new Request("http://localhost/hello");
+    (req as any)._url = new FastURL("http://localhost/hello");
     const event = new H3Event(req);
     expect(event.url).toBe((req as any)._url);
+  });
+
+  it("reuses the runtime-provided _url when decoding is an identity (reserved chars)", () => {
+    const req = new Request("http://localhost/a%2Fb");
+    (req as any)._url = new FastURL("http://localhost/a%2Fb");
+    const event = new H3Event(req);
+    expect(event.url).toBe((req as any)._url);
+    expect(event.url.pathname).toBe("/a%2Fb");
+  });
+
+  it("clones instead of mutating the runtime-provided _url when decoding", () => {
+    const req = new Request("http://localhost/h%65llo?q=%41");
+    (req as any)._url = new FastURL("http://localhost/h%65llo?q=%41");
+    const event = new H3Event(req);
     expect(event.url.pathname).toBe("/hello");
+    expect(event.url.search).toBe("?q=%41");
+    expect(event.url).not.toBe((req as any)._url);
+    // The shared parsed URL keeps the original wire encoding (#1432)
+    expect(((req as any)._url as URL).pathname).toBe("/h%65llo");
   });
 
   it("does not double-decode when two events share one _url", () => {
@@ -19,8 +37,8 @@ describe("H3Event URL normalization", () => {
     const first = new H3Event(req);
     expect(first.url.pathname).toBe("/a%2541-A");
     const second = new H3Event(req);
-    expect(second.url).toBe(first.url);
     expect(second.url.pathname).toBe("/a%2541-A");
+    expect(((req as any)._url as URL).pathname).toBe("/a%2541-%41");
   });
 });
 
