Skip to content

fix: encode URL path parameters with encodeURIComponent#3651

Merged
ardatan merged 6 commits intomasterfrom
copilot/fix-url-encoding-parameters
Mar 20, 2026
Merged

fix: encode URL path parameters with encodeURIComponent#3651
ardatan merged 6 commits intomasterfrom
copilot/fix-url-encoding-parameters

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 19, 2026

  • Fix TypeScript errors in path-params-encoding.spec.ts
  • Fix Prettier import ordering and formatting
  • Add encodeURIComponent to URL path parameters in createClient
  • Add changeset for the fets package
  • Resolve rebase conflicts: merge origin/master into branch, keeping master's package-lock.json
Original prompt

This section details on the original issue you should resolve

<issue_title>Default url encoding/escaping on url parameters (encodeURIComponent)</issue_title>
<issue_description>Is your feature request related to a problem? Please describe.

First of all, in the brief time frame I had I wasn't able to work with the unit tests to verify this.
That said, after reviewing some code of this lib in the context of another project, I found that it seems that url path parameters are not at all encoded in createClient().

E.g. making a call to /todo/{id} implies url-injection by means of id, while initially I would expect the lib to take care of that, given the use of url/query/body/json builders, all the schema validation and typing provided.

To the devs around me this isn't fully clear and potentially poses security issues.

Describe the solution you'd like

By default, apply encodeURIComponent() to all param values. Optionally make it configurable per instance to use encodeURI() instead, or disable encoding altogether.

Describe alternatives you've considered

Have devs apply encoding on all param values, but it's very error prone and leads to lots of unnecessary discussions.

Additional context
..
</issue_description>

Comments on the Issue (you are @copilot in this section)

@ardatan We use `qs` to handle params; https://github.com/ardatan/feTS/blob/master/packages/fets/src/client/createClient.ts#L223 We can maybe expose the options of that to allow users to modify it. PRs are welcome!

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: ardatan <20847995+ardatan@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix default URL encoding on URL parameters in createClient fix: encode URL path parameters with encodeURIComponent Mar 19, 2026
Copilot AI requested a review from ardatan March 19, 2026 21:32
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 19, 2026

💻 Website Preview

The latest changes are available as preview in: https://09bac72e.fets.pages.dev

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 19, 2026

✅ Benchmark Results

     ✓ no_errors{server:node-http,mode:no-schema}
     ✓ expected_result{server:node-http,mode:no-schema}
     ✓ no_errors{server:node-http,mode:json-schema}
     ✓ expected_result{server:node-http,mode:json-schema}
     ✓ no_errors{server:uWebSockets,mode:no-schema}
     ✓ expected_result{server:uWebSockets,mode:no-schema}
     ✓ no_errors{server:uWebSockets,mode:json-schema}
     ✓ expected_result{server:uWebSockets,mode:json-schema}

     checks......................................: 100.00% ✓ 837852      ✗ 0     
     data_received...............................: 76 MB   633 kB/s
     data_sent...................................: 53 MB   443 kB/s
     http_req_blocked............................: avg=1.59µs   min=902ns    med=1.49µs   max=300.82µs p(90)=2.01µs   p(95)=2.22µs  
     http_req_connecting.........................: avg=1ns      min=0s       med=0s       max=174.82µs p(90)=0s       p(95)=0s      
     http_req_duration...........................: avg=201.54µs min=136.28µs med=191.06µs max=15.32ms  p(90)=218.47µs p(95)=228.09µs
       { expected_response:true }................: avg=201.54µs min=136.28µs med=191.06µs max=15.32ms  p(90)=218.47µs p(95)=228.09µs
     ✓ { server:node-http,mode:json-schema }.....: avg=214.47µs min=153.2µs  med=203.31µs max=12.13ms  p(90)=228.02µs p(95)=236.88µs
     ✓ { server:node-http,mode:no-schema }.......: avg=208.66µs min=146.75µs med=195.11µs max=15.32ms  p(90)=222.19µs p(95)=233.73µs
     ✓ { server:uWebSockets,mode:json-schema }...: avg=196.23µs min=143.64µs med=187.63µs max=13.18ms  p(90)=210.63µs p(95)=218.41µs
     ✓ { server:uWebSockets,mode:no-schema }.....: avg=188.46µs min=136.28µs med=179.76µs max=12.74ms  p(90)=202.57µs p(95)=210.62µs
     http_req_failed.............................: 0.00%   ✓ 0           ✗ 418926
     http_req_receiving..........................: avg=25.85µs  min=12.44µs  med=24.62µs  max=3.29ms   p(90)=30.22µs  p(95)=32.92µs 
     http_req_sending............................: avg=9.44µs   min=5.56µs   med=9.33µs   max=465.76µs p(90)=12.66µs  p(95)=14.17µs 
     http_req_tls_handshaking....................: avg=0s       min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting............................: avg=166.24µs min=107.35µs med=156.88µs max=15.22ms  p(90)=181.33µs p(95)=189.92µs
     http_reqs...................................: 418926  3491.014388/s
     iteration_duration..........................: avg=281.3µs  min=198.99µs med=269.93µs max=15.5ms   p(90)=301.6µs  p(95)=313.67µs
     iterations..................................: 418926  3491.014388/s
     vus.........................................: 1       min=1         max=1   
     vus_max.....................................: 2       min=2         max=2   

Co-authored-by: ardatan <20847995+ardatan@users.noreply.github.com>
Co-authored-by: ardatan <20847995+ardatan@users.noreply.github.com>
Co-authored-by: ardatan <20847995+ardatan@users.noreply.github.com>
…oding-parameters

# Conflicts:
#	package-lock.json
@ardatan ardatan merged commit 3d17b72 into master Mar 20, 2026
18 checks passed
@ardatan ardatan deleted the copilot/fix-url-encoding-parameters branch March 20, 2026 13:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Default url encoding/escaping on url parameters (encodeURIComponent)

2 participants