Fix issue where decode throws - fixes #6

SamVerschueren · Dec 1, 2022 · 746ca5d · 746ca5d
1 parent 486d7e2
commit 746ca5d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 4 deletions.
diff --git a/index.js b/index.js
@@ -6,7 +6,7 @@ var multiMatcher = new RegExp('(' + token + ')+', 'gi');
 function decodeComponents(components, split) {
 	try {
 		// Try to decode the entire string first
-		return decodeURIComponent(components.join(''));
+		return [decodeURIComponent(components.join(''))];
 	} catch (err) {
 		// Do nothing
 	}
@@ -28,12 +28,12 @@ function decode(input) {
 	try {
 		return decodeURIComponent(input);
 	} catch (err) {
-		var tokens = input.match(singleMatcher);
+		var tokens = input.match(singleMatcher) || [];
 
 		for (var i = 1; i < tokens.length; i++) {
 			input = decodeComponents(tokens, i).join('');
 
-			tokens = input.match(singleMatcher);
+			tokens = input.match(singleMatcher) || [];
 		}
 
 		return input;

diff --git a/test.js b/test.js
@@ -32,7 +32,10 @@ const tests = {
 	'%C2x': '\uFFFDx',
 	'%C2%B5': 'µ',
 	'%C2%B5%': 'µ%',
-	'%%C2%B5%': '%µ%'
+	'%%C2%B5%': '%µ%',
+
+	// This should actually return `%ea%baZ%ba`, but fixes a DOS attack for now
+	'%ea%ba%5a%ba': '꺺'
 };
 
 function macro(t, input, expected) {