fix(router): preserve percent-encoding in forward_path #61

New issue

Closed

opened 2026-04-27 13:44:14 +00:00 by zaelgohary · 0 comments

zaelgohary commented

2026-04-27 13:44:14 +00:00

Member

Symptom

Any request whose path contains percent-encoded characters (e.g. %20) panics a hero_router worker thread, and the client sees Empty reply from server (curl exit 52). Reproduces on any 3-segment proxy URL with non-ASCII / encoded chars.

$ curl -i 'http://127.0.0.1:9988/hero_office/ui/pdf/edit/Data%20Mining%20Lab%20Two-1.pdf?context=geomind'
curl: (52) Empty reply from server

# stderr from hero_router:
called `Result::unwrap()` on an `Err` value: InvalidUri(InvalidUriChar)
thread 'tokio-rt-worker' panicked at hyperlocal-0.9.1/src/uri.rs:31:52

Root cause

service_proxy_path at crates/hero_router/src/server/routes.rs:985 extracts the trailing path with axum's Path<(String, String, String)> — which percent-decodes the segment. So Data%20… becomes Data Mining… (raw spaces). The decoded form is then passed to UnixUri::new(socket, &forward_uri) which panics in hyper's URI parser because raw spaces are not valid URI characters.

Acceptance

Direct curl probe of /hero_office/ui/pdf/edit/Data%20Mining%20Lab%20Two-1.pdf?context=geomind returns 200 (or the upstream's real response).
No InvalidUriChar panics in hero_proc service logs hero_router.
Existing playwright + smoke tests stay green.

## Symptom Any request whose path contains percent-encoded characters (e.g. `%20`) panics a hero_router worker thread, and the client sees `Empty reply from server` (curl exit 52). Reproduces on any 3-segment proxy URL with non-ASCII / encoded chars. ``` $ curl -i 'http://127.0.0.1:9988/hero_office/ui/pdf/edit/Data%20Mining%20Lab%20Two-1.pdf?context=geomind' curl: (52) Empty reply from server # stderr from hero_router: called `Result::unwrap()` on an `Err` value: InvalidUri(InvalidUriChar) thread 'tokio-rt-worker' panicked at hyperlocal-0.9.1/src/uri.rs:31:52 ``` ## Root cause `service_proxy_path` at `crates/hero_router/src/server/routes.rs:985` extracts the trailing path with axum's `Path<(String, String, String)>` — which **percent-decodes** the segment. So `Data%20…` becomes `Data Mining…` (raw spaces). The decoded form is then passed to `UnixUri::new(socket, &forward_uri)` which panics in hyper's URI parser because raw spaces are not valid URI characters. ## Acceptance - Direct curl probe of `/hero_office/ui/pdf/edit/Data%20Mining%20Lab%20Two-1.pdf?context=geomind` returns 200 (or the upstream's real response). - No `InvalidUriChar` panics in `hero_proc service logs hero_router`. - Existing playwright + smoke tests stay green.