fix(unplugin): reject invalid hex digits in [x+hh] character codes (#2744)

* fix(unplugin): reject invalid hex digits in [x+hh] character codes

* refactor: review

---------

Co-authored-by: greymoth <246701683+greymoth-jp@users.noreply.github.com>
Co-authored-by: Eduardo San Martin Morote <posva13@gmail.com>

Author: mahirhir

packages/router/src/unplugin/core/tree.spec.ts

@@ -225,6 +225,14 @@ describe('Tree', () => {
       )
     })
 
+    it('throws when only the second digit is not hex', () => {
+      const tree = new PrefixTree(RESOLVED_OPTIONS)
+
+      expect(() => tree.insert('[x+1g]', '[x+1g].vue')).toThrow(
+        /Invalid hex code "1g"/
+      )
+    })
+
     it('throws on too many digits in hex code', () => {
       const tree = new PrefixTree(RESOLVED_OPTIONS)
 

packages/router/src/unplugin/core/treeNodeValue.ts

@@ -9,6 +9,8 @@ export const enum TreeNodeType {
   param,
 }
 
+const RE_HEX_CHARS = /^[0-9a-fA-F]{2}$/
+
 /**
  * Internal merged-overrides shape used by tree nodes. Same structure as
  * {@link CustomRouteBlock} (the user-facing `<route>` block / `definePage()`
@@ -684,13 +686,15 @@ function parseFileSegment(
           `Invalid character code in segment "${segment}". Hex code must be exactly 2 digits, got "${buffer}"`
         )
       }
-      const hexCode = parseInt(buffer, 16)
-      if (!Number.isInteger(hexCode) || hexCode < 0 || hexCode > 255) {
+      // `parseInt` stops at the first non-hex character, so a buffer like
+      // `1g` would be leniently parsed as `0x1` instead of being rejected.
+      // Require both characters to be hex digits before decoding.
+      if (!RE_HEX_CHARS.test(buffer)) {
         throw new SyntaxError(
           `Invalid hex code "${buffer}" in segment "${segment}"`
         )
       }
-      pathSegment += String.fromCharCode(hexCode)
+      pathSegment += String.fromCharCode(parseInt(buffer, 16))
     }
     buffer = ''
   }