fix(cache): try decode path

[cjpearson]

🔗 Linked issue

#2657

❓ Type of change

• 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

This follows the same approach as #1459, replacing the decodeURI with decodePath from ufo. This means that an invalid path will no longer throw an error but instead use the undecoded text.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[pi0]

This is arguably less safe because decodePath falls back to user input (which can be dangerous with unseen paths).

[pi0]

We might have a local try catch system that removes (fallback to empty string or "??" or something like tat) in case of decode failure.

[cjpearson]

So my original approach looked like:

let _pathname: string;
  try {
    _pathname = escapeKey(decodeURI(parseURL(_path).pathname)).slice(0, 16) || "index"
  } catch {
    throw createError({
      message: 'Invalid URL',
      statusCode: 404,
    });
  }

But then I changed to match the behavior of the static handler. Would something like that work better?

We might have a local try catch system that removes (fallback to empty string or "??" or something like tat) in case of decode failure.

I don't think we can use a common fallback because then the cache key will be identical for different paths. If the handler that is wrapped by the cache handler doesn't mind the invalid encoding it may return different responses for different paths and expect them to be cached separately.

But maybe there's another way to mitigate the risk? Could you explain where the risk is since I'm not sure I understand? We are already using the user input to generate the cache key when URI decoding does not fail.

[pi0]

the cache key will be identical for different paths

Full path is always added as hash (L225). _pathname is only a human friendly part to assist identify keys.

[cjpearson]

Oh, I see now. So you're thinking something like this?

let _pathname: string;
try {
  _pathname = escapeKey(decodeURI(parseURL(_path).pathname)).slice(0, 16) || "index"
} catch {
  _pathname = "??"
}

[pi0]

Yes.. Althoigh i guess ? is illegal in windows. Perhaps -?

[cjpearson]

Tested it out locally and this approach works as well. 👍 Thanks for the feedback!