Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not throw if the url hash is not a valid URI component #13247

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

vezaynk
Copy link

@vezaynk vezaynk commented Mar 17, 2025

Some tooling might pass arbitrary strings in the window.location.hash. React Router should not crash if the value is not decodable.

In our case, for example, a user interacted with a URL that Datadog injected some tracking info into and the call turned to:

decodeURIComponent("targetindividualusers---input-raw%20:9999%20--output-http%20OVERRIDE_TARGET|OVERRIDE_PERCENT%%20--http-rewrite-url%20v5/onboarding:v6/interstitials%20--http-set-header%20X-Datadog-Parent-Id:%20--http-set-header%20X-Datadog-Trace-Id:%20--http-set-header%20X-Datadog-Sampling-Priority:1%20--http-allow-url%20/content/v5/onboarding")

...which crashed the view with the following error:

Uncaught URIError: malformed URI sequence

To avoid this in the future, I would like to suggest that a failure to decode the portion of the URL be preventing from throwing, by wrapping in a try-catch.

Copy link

changeset-bot bot commented Mar 17, 2025

⚠️ No Changeset found

Latest commit: ef83f13

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@remix-cla-bot
Copy link
Contributor

remix-cla-bot bot commented Mar 17, 2025

Hi @vezaynk,

Welcome, and thank you for contributing to React Router!

Before we consider your pull request, we ask that you sign our Contributor License Agreement (CLA). We require this only once.

You may review the CLA and sign it by adding your name to contributors.yml.

Once the CLA is signed, the CLA Signed label will be added to the pull request.

If you have already signed the CLA and received this response in error, or if you have any questions, please contact us at [email protected].

Thanks!

- The Remix team

@remix-cla-bot
Copy link
Contributor

remix-cla-bot bot commented Mar 17, 2025

Thank you for signing the Contributor License Agreement. Let's get this merged! 🥳

@vezaynk vezaynk marked this pull request as ready for review March 17, 2025 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant