Skip to content

fix(router-core): preserve encoded slashes in splat params#7893

Open
xianjianlf2 wants to merge 1 commit into
TanStack:mainfrom
xianjianlf2:fix/splat-preserve-encoded-slash-7871
Open

fix(router-core): preserve encoded slashes in splat params#7893
xianjianlf2 wants to merge 1 commit into
TanStack:mainfrom
xianjianlf2:fix/splat-preserve-encoded-slash-7871

Conversation

@xianjianlf2

@xianjianlf2 xianjianlf2 commented Jul 24, 2026

Copy link
Copy Markdown

Fixes #7871.

Splat params span multiple path segments, so decoding the whole splat with decodeURIComponent makes an encoded slash inside a segment indistinguishable from a real path separator.

This decodes splat params segment-by-segment and keeps %2F encoded inside each segment. Other encoded characters in the segment, like %20, %23, and %3D, are still decoded as before. The same helper is used for fuzzy ** params.

Tests:

  • pnpm --dir packages/router-core test:unit --run tests/path.test.ts
  • pnpm --dir packages/router-core test:eslint
  • pnpm --dir packages/history build && pnpm --dir packages/router-core test:types:ts70

Summary by CodeRabbit

  • Bug Fixes
    • Fixed wildcard route parameters so encoded slashes remain part of a single path segment instead of being treated as separators.
    • Improved decoding of reserved characters in wildcard and fuzzy catch-all route matches.
    • Preserved the distinction between encoded slashes and actual path separators.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eb0e52a6-0f51-4c99-a2fe-a57984b4d09e

📥 Commits

Reviewing files that changed from the base of the PR and between 88f366a and cb9af0b.

📒 Files selected for processing (2)
  • packages/router-core/src/new-process-route-tree.ts
  • packages/router-core/tests/path.test.ts

📝 Walkthrough

Walkthrough

Splat parameter decoding now preserves encoded slashes within segments while decoding other characters. Wildcard and fuzzy catch-all extraction use the new behavior, with tests covering both matching modes.

Changes

Splat parameter decoding

Layer / File(s) Summary
Segment-preserving splat decoding
packages/router-core/src/new-process-route-tree.ts
Adds segment-wise splat decoding and applies it to wildcard (*) and fuzzy catch-all (**) parameters.
Splat decoding coverage
packages/router-core/tests/path.test.ts
Tests encoded slashes, real separators, reserved characters, and fuzzy catch-all decoding.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: package: router-core

Suggested reviewers: sheraff

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: preserving encoded slashes in router-core splat params.
Linked Issues check ✅ Passed The changes satisfy #7871 by preserving encoded slashes in splat and fuzzy params while keeping other decoding behavior intact.
Out of Scope Changes check ✅ Passed The code and tests stay focused on splat-param decoding and do not introduce unrelated changes.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Splat params with an encoded %2F becomes indistinguishable from a path separator

1 participant