rentv: guard decodeURIComponent at server.js:2884 so /admin%25 (malformed %) falls through to 404 instead of 500 (TK-10685)

014a1608627a87d7b2ed8405b2f0cfd7f3273d2f · 2026-08-19 23:03:22 -0700 · steve

Files touched

M server.js

Diff

commit 014a1608627a87d7b2ed8405b2f0cfd7f3273d2f
Author: steve <steve@designerwallcoverings.com>
Date:   Wed Aug 19 23:03:22 2026 -0700

    rentv: guard decodeURIComponent at server.js:2884 so /admin%25 (malformed %) falls through to 404 instead of 500 (TK-10685)
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 71088446..1b7f010f 100644
--- a/server.js
+++ b/server.js
@@ -2881,7 +2881,7 @@ app.post('/api/live/enhance', adminOnly, async (q, r) => {
 // Non-HTML assets (js/css/img/json/mp4) fall straight through to express.static untouched.
 app.use((req, res, next) => {
   if (req.method !== 'GET') return next();
-  let rel = decodeURIComponent(req.path);
+  let rel; try { rel = decodeURIComponent(req.path); } catch { return next(); }
   if (rel.endsWith('/')) rel += 'index.html';
   if (!/\.html?$/i.test(rel)) {
     if (fs.existsSync(path.join(PUB, rel + '.html'))) rel += '.html';

← 16786a3e auto-data-snapshot: 2026-08-19T22:44:23 (7 data files) — dat · back to Rentv · auto-data-snapshot: 2026-08-19T23:16:54 (7 data files) — dat efc19dab →