fix(core): Wrap decodeURI in node stack trace parser to handle malformed URIs#19400
Merged
fix(core): Wrap decodeURI in node stack trace parser to handle malformed URIs#19400
Conversation
…med URIs Fixes #19391 Co-authored-by: Cursor <cursoragent@cursor.com>
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
Contributor
Codecov Results 📊✅ 1698 passed | Total: 1698 | Pass Rate: 100% | Execution Time: 1m 7s All tests are passing successfully. ✅ Patch coverage is 100.00%. Project has 7307 uncovered lines. Files with missing lines (208)
Generated by Codecov Action |
Contributor
size-limit report 📦
|
Contributor
node-overhead report 🧳Note: This is a synthetic benchmark with a minimal express app and does not necessarily reflect the real-world performance impact in an application.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| filename: filename ? decodeURI(filename) : undefined, | ||
| module: getModule ? getModule(filename) : undefined, | ||
| filename: maybeDecodedFilename ?? filename, | ||
| module: maybeDecodedFilename && getModule?.(maybeDecodedFilename), |
There was a problem hiding this comment.
Module not computed when URI decoding fails
Medium Severity
When _safeDecodeURI returns undefined for a malformed URI, maybeDecodedFilename && getModule?.(...) short-circuits to undefined, so the module field is always lost. The raw filename is available and could still be passed to getModule to compute a meaningful module value. The fallback for filename correctly uses ?? filename, but module doesn't apply the same fallback strategy.
Member
Author
There was a problem hiding this comment.
This is intentional. getModule implementors also need to call decodeURI, so they'll end up with the same error being thrown in this code path. I think it's reasonable here to just not include the module, given that we can't make a file lookup anyway if we're dealing with a malformed filename (for reasons unknown)
This was referenced Feb 19, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR wraps
decodeURIinnode-stack-trace.tswith a try/catch so that malformed URIs (e.g. filenames containing%sequences that are not valid percent-encoding) no longer throw aURIErrorand crash the SDK. The raw filename is returned as a fallback. In addition, we only callgetModuleif we successfully decode the filename, since ingetModuleimplementations, we also again attempt to decode filenames.Since we don't have a concrete filename in #19391 which we can reproduce this, this is rather a "best effort" fix. But I think it's worth having this either way.
Closes #19391