Skip to content

fix(router-core): preserve encoded slashes in splat params - #7893

Open
xianjianlf2 wants to merge 2 commits into
TanStack:mainfrom
xianjianlf2:fix/splat-preserve-encoded-slash-7871
Open

fix(router-core): preserve encoded slashes in splat params#7893
xianjianlf2 wants to merge 2 commits into
TanStack:mainfrom
xianjianlf2:fix/splat-preserve-encoded-slash-7871

Conversation

@xianjianlf2

@xianjianlf2 xianjianlf2 commented Jul 24, 2026

Copy link
Copy Markdown

Fixes #7871.

Splat params span multiple path segments, so decoding the whole splat with decodeURIComponent makes an encoded slash inside a segment indistinguishable from a real path separator.

This decodes splat params segment-by-segment and keeps %2F encoded inside each segment. Other encoded characters in the segment, like %20, %23, and %3D, are still decoded as before. The same helper is used for fuzzy ** params.

Tests:

  • pnpm --dir packages/router-core test:unit --run tests/path.test.ts
  • pnpm --dir packages/router-core test:eslint
  • pnpm --dir packages/history build && pnpm --dir packages/router-core test:types:ts70

Summary by CodeRabbit

  • Bug Fixes
    • Fixed wildcard (*) and fuzzy catch-all (**) route parameter decoding so encoded slashes (%2F) stay within the same matched segment.
    • Improved handling of reserved characters inside wildcard and fuzzy catch-all matches.
    • Ensured encoded slashes are not treated the same as real path separators (/).
  • Tests
    • Extended route matching tests to cover encoded-slash preservation and fuzzy catch-all behavior.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: beea553e-a80c-4b46-bc17-32b30c2357f8

📥 Commits

Reviewing files that changed from the base of the PR and between cb9af0b and eda57d8.

📒 Files selected for processing (1)
  • packages/router-core/src/new-process-route-tree.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • packages/router-core/src/new-process-route-tree.ts

📝 Walkthrough

Walkthrough

Splat parameter decoding preserves encoded slashes within segments while decoding other characters. Wildcard and fuzzy catch-all extraction use the new behavior, with tests covering both matching modes.

Changes

Splat parameter decoding

Layer / File(s) Summary
Segment-preserving splat decoding
packages/router-core/src/new-process-route-tree.ts
Adds segment-wise splat decoding and applies it to wildcard (*) and fuzzy catch-all (**) parameters.
Splat decoding coverage
packages/router-core/tests/path.test.ts
Tests encoded slashes, real separators, reserved characters, and fuzzy catch-all decoding.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main router-core change: preserving encoded slashes in splat params.
Linked Issues check ✅ Passed The code and tests directly address issue #7871 by preserving encoded slashes within splat and fuzzy catch-all params.
Out of Scope Changes check ✅ Passed The changes stay focused on splat decoding behavior and matching tests, with no unrelated scope introduced.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@xianjianlf2

Copy link
Copy Markdown
Author

Added a short docstring for the splat decoding helper to clarify why decoding happens segment-by-segment and why encoded slashes stay escaped.

Local check:

  • pnpm --dir packages/router-core test:unit --run tests/path.test.ts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Splat params with an encoded %2F becomes indistinguishable from a path separator

1 participant