Skip to content

Conversation

@ynakoo
Copy link

@ynakoo ynakoo commented Dec 3, 2025

Fix: Prevent Double-Encoding of Percent Signs in Route Parameters

This PR fixes an issue where route parameters containing percent-encoded sequences (e.g., %20, %25) were being double-encoded when passed through generatePath.
The root cause was that matchPath partially decodes certain sequences (like %2F → /) while leaving other encoded sequences intact, which caused generatePath to treat already-encoded values as raw text and encode them again.

Example of incorrect behavior:

  • %20 → %2520

  • %25 → %2525

This resulted in incorrect URLs and broke RFC 3986–compliant workflows.

Technical Details

  • Introduces a new helper safeEncode that wraps encodeURIComponent.
  • After normal encoding, it detects and replaces double-encoded sequences—such as %2520—back to their correct single-encoded forms (e.g., %20).
  • Ensures that mixed encoded/unencoded params continue to work as expected.
  • Behavior is now consistent and prevents accidental double-encoding while still ensuring safe URL generation.

FIXES ISSUE
#14619

@changeset-bot
Copy link

changeset-bot bot commented Dec 3, 2025

⚠️ No Changeset found

Latest commit: 2e61079

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@remix-cla-bot
Copy link
Contributor

remix-cla-bot bot commented Dec 3, 2025

Hi @ynakoo,

Welcome, and thank you for contributing to React Router!

Before we consider your pull request, we ask that you sign our Contributor License Agreement (CLA). We require this only once.

You may review the CLA and sign it by adding your name to contributors.yml.

Once the CLA is signed, the CLA Signed label will be added to the pull request.

If you have already signed the CLA and received this response in error, or if you have any questions, please contact us at hello@remix.run.

Thanks!

- The Remix team

@ynakoo
Copy link
Author

ynakoo commented Dec 3, 2025

CLA signed

@timdorr
Copy link
Member

timdorr commented Dec 3, 2025

@ynakoo You need to add your name to the contributors.yml file.

Can you rebase against the latest dev branch?

@timdorr
Copy link
Member

timdorr commented Dec 4, 2025

@ynakoo You should be running git fetch origin and git rebase origin/dev locally to rebase. You shouldn't merge in from main.

Actually, I was able to do that for you. I guess they changed the permissions for maintainers to force push.

Fixes a bug where route parameters containing both spaces and percent signs were incorrectly double-encoded during path generation. Implements a safe encoder that preserves already-encoded sequences while ensuring RFC 3986 compliance.
@timdorr timdorr force-pushed the fix/double-encoding branch from 0e578e3 to e8777d7 Compare December 4, 2025 17:02
@ynakoo ynakoo force-pushed the fix/double-encoding branch from 60ddb1f to 74f65cc Compare December 4, 2025 17:28
@remix-cla-bot
Copy link
Contributor

remix-cla-bot bot commented Dec 4, 2025

Thank you for signing the Contributor License Agreement. Let's get this merged! 🥳

@ynakoo
Copy link
Author

ynakoo commented Dec 4, 2025

Member
Thanks for the help. I saw that you rebased it and force pushed it.
I pushed the contributor.yml update afterward because I have not checked your comment. Let me know if you need anything else from my side.

@timdorr timdorr force-pushed the fix/double-encoding branch from 74f65cc to 2e61079 Compare December 4, 2025 18:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Route params are incorrectly percent-encoded/decoded when containing spaces and percent signs

3 participants