Function decodePath

packages/router-core/src/utils.ts:617–649

(path: string)

}

export function decodePath(path: string) {
  if (!path) return { path, handledProtocolRelativeURL: false }

  // Fast path: most paths are already decoded and safe.
  // Only fall back to the slower scan/regex path when we see a '%' (encoded),
  // a backslash (explicitly handled), a control character, or a protocol-relative
  // prefix which needs collapsing.
  // eslint-disable-next-line no-control-regex
  if (!/[%\\\x00-\x1f\x7f]/.test(path) && !path.startsWith('//')) {
    return { path, handledProtocolRelativeURL: false }
  }

  const re = /%25|%5C/gi
  let cursor = 0
  let result = ''
  let match
  while (null !== (match = re.exec(path))) {
    result += decodeSegment(path.slice(cursor, match.index)) + match[0]
    cursor = re.lastIndex
  }
  result = result + decodeSegment(cursor ? path.slice(cursor) : path)

  // Prevent open redirect via protocol-relative URLs (e.g. "//evil.com")
  // After sanitizing control characters, paths like "/\r/evil.com" become "//evil.com"
  // Collapse leading double slashes to a single slash
  let handledProtocolRelativeURL = false
  if (result.startsWith('//')) {
    handledProtocolRelativeURL = true
    result = '/' + result.replace(/^\/+/, '')
  }

  return { path: result, handledProtocolRelativeURL }
}

/**
 * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.