@@W-19811971@@ - Fix address name encoding for server double-decoding issue - #3380
Merged
Conversation
## Fix address name encoding for server double-decoding issue ### Problem The server performs double URL decoding on address names, causing special characters (like `&`, `#`, spaces) to be incorrectly decoded when passed as URL parameters in address mutations. ### Solution - Added `serverSafeEncode()` utility function in `utils/url.js` that applies URL encoding to work around the server's double-decoding behavior - Updated `addresses.jsx` to use `serverSafeEncode()` for `addressName` parameters in both update and remove address mutations - Added comprehensive tests covering various character types and edge cases ### Changes - **New utility**: `serverSafeEncode()` function with JSDoc documentation - **Updated**: Address mutations now encode `addressName` before sending to server - **Added**: 7 test cases for the new utility function ### Future Maintenance The utility is centralized in one place, making it easy to revert if the server-side double-decoding issue is fixed in the future by simply changing the function implementation.
Collaborator
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
bfeister
reviewed
Oct 7, 2025
| }) | ||
| }) | ||
|
|
||
| describe('serverSafeEncode', () => { |
Contributor
There was a problem hiding this comment.
Only other thing I can think of is the gross double-encoding scenario, so that would be a test case like
test('correctly double encodes', () => {
const input = 'My%20Address%20%26%20Co.'
const encoded = serverSafeEncode(input)
// Decode should give us original string
const decoded = decodeURIComponent(encoded)
expect(decoded).toBe(input)
})
bfeister
previously approved these changes
Oct 7, 2025
bfeister
left a comment
Contributor
There was a problem hiding this comment.
Small edge case for coverage if you like, but looks good 👍
bfeister
approved these changes
Oct 7, 2025
alexvuong
approved these changes
Oct 7, 2025
| // Decode should give us original string | ||
| const decoded = decodeURIComponent(encoded) | ||
| expect(decoded).toBe(input) | ||
| }) |
There was a problem hiding this comment.
Could you add test case for "abc%"?
test('correctly double encodes', () => {
const input = 'abc%'
const encoded = serverSafeEncode(input)
// Decode should give us original string
const decoded = decodeURIComponent(encoded)
expect(decoded).toBe(input)
}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix address name encoding for server double-decoding issue
Problem
The server (SCAPI) performs double URL decoding on address names (potentially others), causing special characters (like
%,,) to be incorrectly decoded when passed as URL parameters in address mutations, causing a 500 error.Solution
serverSafeEncode()utility function inutils/url.jsthat applies URL encoding to work around the server's double-decoding behavioraddresses.jsxto useserverSafeEncode()foraddressNameparameters in both update and remove address mutationsChanges
serverSafeEncode()function with JSDoc documentationaddressNamebefore sending to serverFuture Maintenance
The utility is centralized in one place, making it easy to revert if the server-side double-decoding issue is fixed in the future by simply changing the function implementation.
How to test drive this:
Home%%as the address name.This should work without issue. If you test this on production demo site you'll see a 500 error on save of the pwa kit address.