From 1a6ba84b3ad34cf48ff7ec702ff4ff14b9a5006e Mon Sep 17 00:00:00 2001
From: coo1estguy <70365929+coolestcodeguy@users.noreply.github.com>
Date: Sat, 19 Sep 2026 14:58:53 +0530
Subject: [PATCH] fix(api): handle malformed URI parameters gracefully in
 router

---
 src/services/api/router.ts | 7 ++++++-
 tests/api.test.ts          | 9 +++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/services/api/router.ts b/src/services/api/router.ts
index 21da634..5f432c5 100644
--- a/src/services/api/router.ts
+++ b/src/services/api/router.ts
@@ -66,7 +66,12 @@ export class Router {
         const seg = route.segments[i]!;
         const part = parts[i]!;
         if (seg.startsWith(":")) {
-          params[seg.slice(1)] = decodeURIComponent(part);
+          try {
+            params[seg.slice(1)] = decodeURIComponent(part);
+          } catch {
+            ok = false;
+            break;
+          }
         } else if (seg !== part) {
           ok = false;
           break;
diff --git a/tests/api.test.ts b/tests/api.test.ts
index f22d3e4..10ba74e 100644
--- a/tests/api.test.ts
+++ b/tests/api.test.ts
@@ -1155,4 +1155,13 @@ describe("Router param decoding", () => {
     expect(router.match("GET", "/v1/users/123/extra")).toBeNull();
     expect(router.match("POST", "/v1/users/123")).toBeNull();
   });
+
+  it("handles malformed URI parameters gracefully without throwing", () => {
+    const router = new Router();
+    const handler = vi.fn();
+    router.get("/v1/users/:id", handler);
+
+    expect(router.match("GET", "/v1/users/%FF")).toBeNull();
+    expect(router.match("GET", "/v1/users/%c0%af")).toBeNull();
+  });
 });