From b145a4e6001ed7d3adbd3cdf8461ed89000636b2 Mon Sep 17 00:00:00 2001 From: Sheraff Date: Sun, 25 Jan 2026 11:40:26 +0100 Subject: [PATCH 1/2] refactor(router-core): decodePath fast path when no encoded chars --- packages/router-core/src/utils.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/packages/router-core/src/utils.ts b/packages/router-core/src/utils.ts index f8fc8d56590..9cd35335b8f 100644 --- a/packages/router-core/src/utils.ts +++ b/packages/router-core/src/utils.ts @@ -593,8 +593,19 @@ export function escapeHtml(str: string): string { return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!) } + export function decodePath(path: string, decodeIgnore?: Array): string { if (!path) return path + + // Fast path: most paths are already decoded and safe. + // Only fall back to the slower scan/regex path when we see a '%' (encoded), + // a backslash (explicitly handled), a control character, or a protocol-relative + // prefix which needs collapsing. + // eslint-disable-next-line no-control-regex + if (!/[%\\\x00-\x1f\x7f]/.test(path) && !path.startsWith('//')) { + return path + } + const re = decodeIgnore ? new RegExp(`${decodeIgnore.join('|')}`, 'gi') : /%25|%5C/gi From e30a1fb0a2d5ea6159fd53d99c86f1991cf76439 Mon Sep 17 00:00:00 2001 From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com> Date: Sun, 25 Jan 2026 10:45:40 +0000 Subject: [PATCH 2/2] ci: apply automated fixes --- packages/router-core/src/utils.ts | 1 - 1 file changed, 1 deletion(-) diff --git a/packages/router-core/src/utils.ts b/packages/router-core/src/utils.ts index 9cd35335b8f..d6046ea37c9 100644 --- a/packages/router-core/src/utils.ts +++ b/packages/router-core/src/utils.ts @@ -593,7 +593,6 @@ export function escapeHtml(str: string): string { return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!) } - export function decodePath(path: string, decodeIgnore?: Array): string { if (!path) return path