URIError: URI malformed crashes the server when receiving overlong UTF-8 encoded URLs (e.g. %C0%80)

[FlorianV85]

Package version

v7.3.0 (@adonisjs/core) - (so @adonisjs/http-server v8.1.1)

Describe the bug

My server crashed with this error. It was probably a bot (or a curious user) that tried to visit an invalid URL containing UTF-8 encoded like %C0%80. I can reproduce the issue in a blank project. Follow the steps below to reproduce it.

Error

file:///opt/render/project/src/node_modules/.pnpm/@adonisjs+http-server@8.1.1_@adonisjs+application@9.0.0_@adonisjs+assembler@8.4.0_types_8156d8216447599563947f63120a27f3/node_modules/@adonisjs/http-server/build/utils-BjSHKI3s.js:613
		pathname: shouldDecode ? decodeURI(path) : path,
		                         ^
Menu
URIError: URI malformed
    at decodeURI (<anonymous>)
    at safeDecodeURI (file:///opt/render/project/src/node_modules/.pnpm/@adonisjs+http-server@8.1.1_@adonisjs+application@9.0.0_@adonisjs+assembler@8.4.0_types_8156d8216447599563947f63120a27f3/node_modules/@adonisjs/http-server/build/utils-BjSHKI3s.js:613:28)
    at new HttpRequest (file:///opt/render/project/src/node_modules/.pnpm/@adonisjs+http-server@8.1.1_@adonisjs+application@9.0.0_@adonisjs+assembler@8.4.0_types_8156d8216447599563947f63120a27f3/node_modules/@adonisjs/http-server/build/define_config-CfKSwwjk.js:777:20)
    at Server.createRequest (file:///opt/render/project/src/node_modules/.pnpm/@adonisjs+http-server@8.1.1_@adonisjs+application@9.0.0_@adonisjs+assembler@8.4.0_types_8156d8216447599563947f63120a27f3/node_modules/@adonisjs/http-server/build/define_config-CfKSwwjk.js:2365:10)
    at Server.handle (file:///opt/render/project/src/node_modules/.pnpm/@adonisjs+http-server@8.1.1_@adonisjs+application@9.0.0_@adonisjs+assembler@8.4.0_types_8156d8216447599563947f63120a27f3/node_modules/@adonisjs/http-server/build/define_config-CfKSwwjk.js:2379:43)
    at Server.emit (node:events:508:28)
    at parserOnIncoming (node:_http_server:1210:12)
    at HTTPParser.parserOnHeadersComplete (node:_http_common:125:17)
Node.js v24.14.0

Reproduction

1. Start an AdonisJS server
2. Run curl http://localhost:3333/%C0%80
3. Server crashes with URIError: URI malformed

Suggested fix

Try catch in utils.ts > safeDecodeURI()

- const decodedPath = shouldDecode ? decodeURI(path) : path
+ let decodedPath = path
+  if (shouldDecode) {
+    try {
+      decodedPath = decodeURI(path)
+    } catch {
+      decodedPath = path
+    }
+  }

And add this test :

  test('handle malformed UTF-8 sequences gracefully', ({ assert }) => {
    assert.deepEqual(safeDecodeURI('/%C0%80', false), {
      pathname: '/%C0%80',
      query: '',
      shouldDecodeParam: false,
    })
  })

Reproduction repo

No response

[FlorianV85]

I've added a suggested fix. Feel free to say if you want a PR!