fix: guard decodeURIComponent against malformed percent-encoding in browser relay#11880
Closed
Yida-Dev wants to merge 1 commit intoopenclaw:mainfrom
Closed
fix: guard decodeURIComponent against malformed percent-encoding in browser relay#11880Yida-Dev wants to merge 1 commit intoopenclaw:mainfrom
Yida-Dev wants to merge 1 commit intoopenclaw:mainfrom
Conversation
decodeURIComponent throws URIError on malformed percent-encoded input (e.g. %E0%A4%A). In extension-relay.ts, this happens inside a bare HTTP request handler with no surrounding try-catch, causing the server to crash. In dispatcher.ts, the call is before the route handler's try-catch block, so the error propagates as an unhandled rejection. Wrap all three callsites in try-catch blocks that return 400 responses for invalid input, preventing server crashes from crafted URLs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
bfc1ccb to
f92900f
Compare
|
This pull request has been automatically marked as stale due to inactivity. |
Contributor
|
Landed on What landed:
SHA mapping:
Thanks for the fix, @Yida-Dev. |
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
execute008
pushed a commit
to execute008/openclaw
that referenced
this pull request
Feb 27, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
r4jiv007
pushed a commit
to r4jiv007/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
mylukin
pushed a commit
to mylukin/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
wanjizheng
pushed a commit
to wanjizheng/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com> (cherry picked from commit 8a38bf0)
vincentkoc
pushed a commit
to Sid-Qin/openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
vincentkoc
pushed a commit
to rylena/rylen-openclaw
that referenced
this pull request
Feb 28, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
steipete
added a commit
to Sid-Qin/openclaw
that referenced
this pull request
Mar 2, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
robertchang-ga
pushed a commit
to robertchang-ga/openclaw
that referenced
this pull request
Mar 2, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
dorgonman
pushed a commit
to kanohorizonia/openclaw
that referenced
this pull request
Mar 3, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
zooqueen
pushed a commit
to hanzoai/bot
that referenced
this pull request
Mar 6, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
thebenjaminlee
pushed a commit
to escape-velocity-ventures/openclaw
that referenced
this pull request
Mar 7, 2026
Guard malformed percent-encoding in relay target routes and browser dispatcher params, add regression tests, and update changelog. Landed from contributor @Yida-Dev (PR openclaw#11880). Co-authored-by: Yida-Dev <reyifeijun@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
decodeURIComponentthrowsURIErroron malformed percent-encoded input (e.g.%E0%A4%A)extension-relay.ts,decodeURIComponentis called inside a barecreateServerrequest handler with no surrounding try-catch — a crafted URL like/json/activate/%E0%A4%Acrashes the HTTP serverdispatcher.ts,decodeURIComponentis called before the route handler's try-catch block (line 108), so the error propagates as an unhandled rejectionTest plan
decodeURIComponentcallsCo-Authored-By: Claude Opus 4.6 noreply@anthropic.com
Greptile Overview
Greptile Summary
This PR hardens the browser-side routing/relay code against
decodeURIComponentthrowingURIErroron malformed percent-encoded path segments.src/browser/extension-relay.ts, the/json/activate/:idand/json/close/:idhandlers now wrapdecodeURIComponent(...)in atry/catchand return an HTTP 400 with a clear error message instead of letting a crafted URL crash the HTTP server.src/browser/routes/dispatcher.ts, route param decoding is now guarded similarly; malformed path parameters return a{ status: 400, body: { error: ... } }response before the route handler runs.These changes fit cleanly into the existing request/dispatch flow and are localized to the existing decode callsites.
Confidence Score: 5/5
decodeURIComponentcallsites withtry/catchand returning 400s on invalid percent-encoding; no control-flow regressions were found in the edited handlers/dispatcher path and behavior is consistent with existing response patterns.