Percent-decode a URL-encoded string.
(input: &str)
| 619 | |
| 620 | /// Percent-decode a URL-encoded string. |
| 621 | fn percent_decode(input: &str) -> String { |
| 622 | let mut decoded = Vec::with_capacity(input.len()); |
| 623 | let mut bytes = input.bytes(); |
| 624 | while let Some(b) = bytes.next() { |
| 625 | if b == b'%' { |
| 626 | let hi = bytes.next(); |
| 627 | let lo = bytes.next(); |
| 628 | if let (Some(h), Some(l)) = (hi, lo) { |
| 629 | let hex = [h, l]; |
| 630 | if let Ok(s) = std::str::from_utf8(&hex) |
| 631 | && let Ok(val) = u8::from_str_radix(s, 16) |
| 632 | { |
| 633 | decoded.push(val); |
| 634 | continue; |
| 635 | } |
| 636 | // Invalid percent encoding — preserve verbatim |
| 637 | decoded.push(b'%'); |
| 638 | decoded.push(h); |
| 639 | decoded.push(l); |
| 640 | } else { |
| 641 | decoded.push(b'%'); |
| 642 | if let Some(h) = hi { |
| 643 | decoded.push(h); |
| 644 | } |
| 645 | } |
| 646 | } else { |
| 647 | decoded.push(b); |
| 648 | } |
| 649 | } |
| 650 | String::from_utf8_lossy(&decoded).into_owned() |
| 651 | } |
| 652 | |
| 653 | // --------------------------------------------------------------------------- |
| 654 | // Path credential validation (F3 — CWE-22) |