fix(request): prevent decode:true from reintroducing path separators

pi0 · claude · pi0 · commit cd03d4164c71 · 2026-07-06T20:24:47.000Z
`getRouterParams({ decode: true })` applied `decodeURIComponent` on top of
the pathname that `event.ts` already decoded once (via `decodeURI`, which
preserves reserved chars). A second decode could collapse encoded separators
(`%2f`→`/`, `%5c`→`\`, and `%25`-nested forms) into raw separators,
reintroducing `..` traversal that route matching and pathname-based
middleware never saw.

Decoding now skips over encoded path separators, keeping them in their
encoded form while every other escape still decodes normally. Applies to
`getRouterParam` and `getValidatedRouterParams` via delegation.

Co-Authored-By: Claude Fable 5 &lt;noreply@anthropic.com&gt;
diff --git a/src/utils/request.ts b/src/utils/request.ts
@@ -170,7 +170,9 @@ export function getValidatedQuery(
 /**
  * Get matched route params.
  *
- * If `decode` option is `true`, it will decode the matched route params using `decodeURIComponent`.
+ * If `decode` option is `true`, it will decode the matched route params (like
+ * `decodeURIComponent`), except encoded path separators (`%2f`, `%5c`) are kept
+ * encoded so decoding can never reintroduce a `/` or `\` the router never matched.
  *
  * @example
  * app.get("/", (event) => {
@@ -187,12 +189,47 @@ export function getRouterParams(
   if (opts.decode) {
     params = { ...params };
     for (const key in params) {
-      params[key] = decodeURIComponent(params[key]);
+      params[key] = decodeRouterParam(params[key]);
     }
   }
   return params;
 }
 
+// Percent-encoded path separators (`%2f` → `/`, `%5c` → `\`) at any `%25`-nesting
+// depth (`%2f`, `%252f`, ...). The pathname decode in `event.ts` (decodeURI)
+// deliberately preserves these, so route matching and any pathname-based
+// middleware only ever saw the matched param as one opaque, still-encoded
+// segment (a `:id` capture can never hold a raw separator).
+const ENCODED_SEP_RE_G = /%(?:25)*(?:2f|5c)/gi;
+
+/**
+ * `decodeURIComponent` a matched route param, but never let an encoded path
+ * separator collapse into a raw `/` or `\`.
+ *
+ * A full second decode on top of the already-once-decoded pathname would
+ * reintroduce a separator (and thus `..`-based traversal) the routing/middleware
+ * layer could not see — a path desync / smuggling vector when the decoded param
+ * feeds a filesystem or upstream path. So the encoded separators are kept in
+ * their encoded form while every other escape (spaces, non-ASCII, ...) still
+ * decodes normally, keeping `decode:true` human-readable.
+ */
+function decodeRouterParam(value: string): string {
+  if (!value.includes("%")) {
+    return value; // Fast path: nothing to decode.
+  }
+  // Decode around the encoded separators: split on them, decode the pieces, and
+  // rejoin keeping each separator in its original (encoded) form so it can never
+  // become a raw separator.
+  let result = "";
+  let lastIndex = 0;
+  ENCODED_SEP_RE_G.lastIndex = 0;
+  for (let m: RegExpExecArray | null; (m = ENCODED_SEP_RE_G.exec(value)); ) {
+    result += decodeURIComponent(value.slice(lastIndex, m.index)) + m[0];
+    lastIndex = m.index + m[0].length;
+  }
+  return result + decodeURIComponent(value.slice(lastIndex));
+}
+
 export function getValidatedRouterParams<Event extends HTTPEvent, S extends StandardSchemaV1>(
   event: Event,
   validate: S,
@@ -216,7 +253,9 @@ export function getValidatedRouterParams<
 /**
  * Get matched route params and validate with validate function.
  *
- * If `decode` option is `true`, it will decode the matched route params using `decodeURIComponent`.
+ * If `decode` option is `true`, it will decode the matched route params (like
+ * `decodeURIComponent`), except encoded path separators (`%2f`, `%5c`) are kept
+ * encoded so decoding can never reintroduce a `/` or `\` the router never matched.
  *
  * You can use a simple function to validate the params object or use a Standard-Schema compatible library like `zod` to define a schema.
  *
@@ -279,7 +318,9 @@ export function getValidatedRouterParams(
 /**
  * Get a matched route param by name.
  *
- * If `decode` option is `true`, it will decode the matched route param using `decodeURIComponent`.
+ * If `decode` option is `true`, it will decode the matched route param (like
+ * `decodeURIComponent`), except encoded path separators (`%2f`, `%5c`) are kept
+ * encoded so decoding can never reintroduce a `/` or `\` the router never matched.
  *
  * @example
  * app.get("/", (event) => {
diff --git a/test/router.test.ts b/test/router.test.ts
@@ -138,6 +138,36 @@ describeMatrix("router", (t, { it, expect, describe }) => {
 
         expect(await result.text()).toBe("200");
       });
+
+      it("decode does not reintroduce path separators or traversal", async () => {
+        // `decode:true` must not be able to turn an encoded path separator
+        // (`%2f`/`%5c`) that route matching and pathname-based middleware only
+        // ever saw as one opaque, still-encoded segment into a raw `/` or `\`
+        // (and thus `..`-based traversal) — a path desync / smuggling vector.
+        t.app.get("/files/:id", (event) => {
+          return getRouterParams(event, { decode: true }).id;
+        });
+
+        const encodedSlash = await (await t.fetch("/files/%2F")).text();
+        expect(encodedSlash).not.toContain("/");
+
+        const encodedBackslash = await (await t.fetch("/files/%5C")).text();
+        expect(encodedBackslash).not.toContain("\\");
+
+        const encodedTraversal = await (await t.fetch("/files/%2E%2E%2Fetc")).text();
+        expect(encodedTraversal).not.toContain("/");
+        expect(encodedTraversal).not.toContain("../");
+
+        // Double-encoded separator must not decode down to a raw `/` either.
+        const doubleEncodedSlash = await (await t.fetch("/files/%252F")).text();
+        expect(doubleEncodedSlash).not.toContain("/");
+
+        // Legitimate decoding of other characters is preserved.
+        const spaced = await (await t.fetch("/files/a%20b")).text();
+        expect(spaced).toBe("a b");
+        const nonAscii = await (await t.fetch("/files/caf%C3%A9")).text();
+        expect(nonAscii).toBe("café");
+      });
     });
 
     describe("without router", () => {
