Special URL will cause URL Malformed error which broke the asterisk match, this especially impact SSR mode.

[zslucky]

Version

3.0.6

Reproduction link

https://codesandbox.io/s/wq6llvoxr7?fontsize=14

Steps to reproduce

1. Config a simple router. (this step can be finished by using vue-cli, can quickly create a project with vue-router)

router = [
  { path: '/', component: 'home' },
  { path: '*', component: '404' },
]

2. Using follow url in browser address bar. http://localhost:3000/a'a'b"c>%3f>%25%7D%7D%25%25>c<[[%3f$%7B%7B%25%7D%7Dcake//property

What is expected?

1. In SPA, it should match 404 page which I configured.
2. In SSR mode, it also should return the correct matched info.

What is actually happening?

1. In SPA, got js error and blocked app.
2. In SSR mode, can only handle error, can't render correct page.

---

This url will cause SSR can't render correct asterisk matched page.

[posva]

Duplicate of #2719
Is fixed in #2723 :)

[zslucky]

@posva Sorry, Looks like not same issue, please double-check my issue, thanks so much.

[zslucky]

@posva I think every url can be matched in asterisk match rule.

[posva]

Ok, I will take a look!

…

On Thu, Apr 18, 2019 at 4:45 AM luckyzhou ***@***.***> wrote: @posva <https://github.com/posva> I think every url can be matched in asterisk match rule. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2722 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAFCE4IFUZIBGIUAXD4CKTLPQ7OFXANCNFSM4HGRZYWA> .

-- Eduardo San Martin Morote

[posva]

Okay, so the problem comes from %25 which is % encoded, that's the one causing the error. Right now it is decoded so users can use the decoded versions of their urls but things are a bit different with asterisk routes where things are not decoded. There are currently multiple problems if we try to decode the %25, it would create problems in other places and also in different browsers because IE doesn't implement the same standard for percents.
For the moment it would be quite difficult to fix this in the current version of Vue router but still possible. For the next version it's something I do take into consideration

Right now you would have to escape the %25 with something like %2525 and then decode that in your code to get the real value

I will create another issue to track the problem with %

Edit: this should be fixale in current version. I was confused with problems regarding query params which are encoded differently

[zslucky]

@posva Hi, thanks so much, this special URL is provided by someone who was scanning my website and try to find vulnerability. So i can't avoid to use this url.

I attempted to investigate the code, decodeURIComponent throw this error, maybe we can only catch it and find is there an global match, if that we can router to this match.