QuickandClaude Fable 5
35a0db7d29
chi matches routes against the raw (escaped) request path, so chi.URLParam returns parameters still percent-encoded when clients escape reserved characters. The web UI sends marker provider IDs via encodeURIComponent, so plugin-based providers like "plugin:6:introdb" arrived as "plugin%3A6%3Aintrodb", breaking validate (400) and update (404) for any provider ID containing a colon. Add a shared decodedURLParam helper and use it in the marker provider, subtitle provider, and watch provider handlers, returning 400 on malformed escape sequences. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
18 lines
567 B
Go
18 lines
567 B
Go
package handlers
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
)
|
|
|
|
// decodedURLParam returns the named chi route parameter with percent-encoding
|
|
// removed. chi matches routes against the raw (escaped) request path, so
|
|
// parameters arrive still encoded when clients escape reserved characters —
|
|
// e.g. encodeURIComponent("plugin:6:introdb") arrives as
|
|
// "plugin%3A6%3Aintrodb". Returns an error for malformed escape sequences.
|
|
func decodedURLParam(r *http.Request, name string) (string, error) {
|
|
return url.PathUnescape(chi.URLParam(r, name))
|
|
}
|