Skip to content

Decode the pages router pathname before matching it - #4074

Open
b84330808 wants to merge 1 commit into
plotly:devfrom
b84330808:fix-pages-pathname-decoding
Open

b84330808 wants to merge 1 commit into
plotly:devfrom
b84330808:fix-pages-pathname-decoding

Conversation

@b84330808

Copy link
Copy Markdown

Fixes #2360

dcc.Location gives the pages router window.location.pathname, which the browser percent-encodes. The router matched that raw value, so:

  • path variables reached layout() and title() still encoded: /report/hello world gave name="hello%20world" and the tab title "Report hello%20world"
  • a page registered with a path that has spaces or non-ASCII characters showed the 404 page

The server-side meta tags already use the decoded request.path, so on first load og:title said "Report hello world" and then the router changed the tab title to "Report hello%20world".

This runs urllib.parse.unquote on the pathname in both router callbacks (sync and async) before the prefix is stripped and the page is matched. Query parameters were already decoded by parse_qs, so path variables now behave the same way.

Decoding lets a %0A in the URL reach _parse_path_variables as a real newline. fnmatch matches it, but the regex that pulls out the variables did not (one variable was cut at the newline, two or more raised IndexError), so that regex now uses re.DOTALL.

Behaviour change: apps that already call unquote() on path variables now decode twice, which only matters for values containing a literal %XX. A path registered in encoded form (for example /my%20page) now has to be written decoded.

Tested on Windows: the new unit test fails before the change and passes after. pytest tests/unit has the same 7 Windows-only failures (path separators in the pages tests, and test_process_server_smoke) with and without the change. I also checked it by hand in Chrome against a local app. I did not run the Selenium integration tests.

I used Claude Code to write this change.

Contributor Checklist

  • I have broken down my PR scope into the following TODO tasks
    • Decode the pathname in the sync and async pages router callbacks
    • Let path variables hold a decoded newline
  • I have run the tests locally and they passed. (refer to testing section in contributing)
  • I have added tests, or extended existing tests, to cover any new features or bugs fixed in this PR

optionals

  • I have added entry in the CHANGELOG.md
  • If this PR needs a follow-up in dash docs, community thread, I have mentioned the relevant URLS as follows

dcc.Location reports window.location.pathname, which the browser
percent-encodes. The pages router matched that raw value, so path
variables reached layout() and title() still encoded ("hello%20world")
and pages whose path has spaces or non-ASCII characters fell through to
the 404 page. The server-side meta tags already use the decoded
request.path, so the two disagreed.

Decode the pathname before stripping the prefix and matching it. Also
let a path variable hold a decoded newline: fnmatch already accepts one,
but the regex that extracts the variables did not.

Fixes plotly#2360

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Variable Path not accounting for HTML encoding

2 participants