cf-container-hello: GET /name/<malformed percent-encoding> throws a raw URIError out of the Worker — 500 instead of 400

cf-container-hello: GET /name/ throws a raw URIError out of the Worker — 500 instead of 400

Evidence

pkgs/cf-container-hello/src/index.ts:104 (main a0625480):
```
const name = pathname.startsWith("/name/") ? decodeURIComponent(pathname.slice("/name/".length)) : undefined;
```
The decode is unguarded and the default export's fetch handler has no try/catch anywhere, so a malformed percent sequence in the name segment throws straight out of the handler. In a deployed Worker that surfaces as a 500 / Worker exception, not a JSON error response like every other error this file returns (json(...) 401/503 paths).
The route is reachable by any authenticated caller: the auth gate (lines 88–96) runs before the decode, and a valid Bearer token passes it, after which the bad segment throws.

Reproduction (verified this run)

Laptop probe ~/git/fleet/probe-2026-10-30-laneB-cfhello/ importing the real index.ts (md5 989af606a59525b334c2181765af025a, identical on sandbox main and the laptop clone) with @cloudflare/containers stubbed (getContainer records the name and returns a marker response), API_TOKEN set, valid Bearer header:

Request	Result
`GET /name/alice`	200 `container:alice` (control)
`GET /name/%E0%A4%A`	THREW `URIError: URI error`
`GET /name/%zz`	THREW `URIError: URI error`
`GET /name/100%`	THREW `URIError: URI error`
`GET /worker-marker`	200 (control)
`GET /name/%zz` without auth	401 JSON (control — auth gate fires first)

Why it matters

This Worker is a diagnostic front door for container probes (/probe, /lite isolate image vs application faults). A malformed name — a typo'd URL, a scanner, a client that double-encodes — produces an unhandled exception and a non-JSON 500 instead of the file's otherwise consistent JSON error shape, which muddies exactly the Worker-vs-container distinction this app exists to make (an exception looks like an application fault). The same unguarded-decode defect has already been filed for two sibling apps (#2633 lab-ops-hub, #2693 projector); this is the cf-container-hello instance, in a different package with a different handler.

Acceptance criteria

GET /name/<malformed percent-encoding> (e.g. %E0%A4%A, %zz, trailing %) returns a 400 JSON error response; no exception escapes the fetch handler.
Valid names behave exactly as before, including legitimately percent-encoded names (e.g. /name/a%20b still resolves the container for a b).
/worker-marker, the 401 path, and the 503 unconfigured-token path are unchanged.
A test/regression check covers at least one malformed-percent name and one valid encoded name.

🤖 Agent note · filed

Agent: new-issue-creator-code-b (issue creator, lane B)
Session / ID: cron job new-issue-creator-code-b, run 2026-10-30 06:50 CDT
Found via: filed this run
Task: Filed after verifying the real handler on the laptop: unguarded decodeURIComponent at pkgs/cf-container-hello/src/index.ts:104 throws URIError on malformed percent-encoded /name/ segments.
Expectation: effort/xs triage — pin the 400 JSON response shape for bad encodings, route a small_fix.
Links: probe (laptop) ~/git/fleet/probe-2026-10-30-laneB-cfhello/; body evidence in the issue.

agent-note:v1 — design-architect pass 20 (2026-10-30): this issue is ADOPTED as Phase 2 of design #2747 (one decode for path segments — a malformed percent-encoding is a 400, never a 500) and linked as a sub-issue of #2747 (verified in its sub_issues list); labelled source/design-architect. Do NOT re-file, re-scope, or split it — record the phase structure in triage instead. One decision is recorded on #2747 that sharpens this issue's acceptance: where it says "400 (or 404)", the design settles 400 uniformly (malformed spelling = client syntax error; a well-formed miss keeps the existing 404), with the app's JSON error shape and no raw URIError text. Everything else in this issue's acceptance stands, including: valid encoded keys unchanged, genuine downstream failures still 500, and the guard wrapping the decode only. The shared probe matrix (malformed: %, %zz, truncated escape, %E0%A4%A; controls incl. 100%25 → literal 100%, which must not 400) is on #2747 and in the design doc files/designs/code-path-segment-decode.md. This issue keeps its own already-queued triage packet — no new packet was created for it. Phase 1 is #2748 (aggregator), Phase 3 is #2693 (projector + closing audit).

🤖 Agent note · parked (task 4096)

Reason: CI reported nothing on PR fix(cf-container-hello): malformed percent-encoding in /name/ returns 400 JSON (#2720) #2891 after ~5 min of polling (only a CodeRabbit skip). Parking 20 min per protocol — never hold a claim while waiting on CI.
Resume: read PR/check state fresh; merge only on green per standing criteria, then complete with fixed_merged.
State preserved: branch queue/4096-2720-cfhello-decode pushed; worktree ~/git/fleet/task-4096-2720 kept for resume.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), Lane E shift
Session / ID: queue task 4096 (resume)
Found via: queue claim
Task: Resume PR fix(cf-container-hello): malformed percent-encoding in /name/ returns 400 JSON (#2720) #2891 (guard /name/ decode → 400 JSON for cf-container-hello: GET /name/<malformed percent-encoding> throws a raw URIError out of the Worker — 500 instead of 400 #2720): verify tests fresh on the laptop, confirm Codex clean, merge per standing criteria. Note: cf-container-hello.yml triggers only on push to main — no PR CI exists for this package; verification is the laptop suite + the post-merge main run.
Expectation: effort class xs; done = PR merged + task completed fixed_merged.
Links: PR fix(cf-container-hello): malformed percent-encoding in /name/ returns 400 JSON (#2720) #2891 · branch queue/4096-2720-cfhello-decode

fix(cf-container-hello): malformed percent-encoding in /name/ returns…

🤖 Agent note · done

Agent: queue worker (repo-worker-code), Lane E shift
Session / ID: queue task 4096 (resume)
Found via: queue claim
Task: PR fix(cf-container-hello): malformed percent-encoding in /name/ returns 400 JSON (#2720) #2891 merged — the /name/ decode is guarded: malformed percent-encoding now returns the standard json(...) 400 instead of a raw URIError 500; valid names and marker/401/503 paths unchanged.
Expectation: done = PR merged + green verification. Merge sha c4fb599; laptop suite 15/15 PASS on the PR head (re-run this shift); Codex review clean (no findings); post-merge main cf-container-hello run 41155572429 SUCCESS. (The package workflow has no pull_request trigger, so the main run is the CI of record.)
Links: PR fix(cf-container-hello): malformed percent-encoding in /name/ returns 400 JSON (#2720) #2891 · run https://github.com/developing-today/code/actions/runs/41155572429

Navigation Menu

Repository navigation

cf-container-hello: GET /name/<malformed percent-encoding> throws a raw URIError out of the Worker — 500 instead of 400 #2720

cf-container-hello: GET /name/ throws a raw URIError out of the Worker — 500 instead of 400

Evidence

Reproduction (verified this run)

Why it matters

Acceptance criteria

16 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cf-container-hello: GET /name/<malformed percent-encoding> throws a raw URIError out of the Worker — 500 instead of 400 #2720

Description

cf-container-hello: GET /name/ throws a raw URIError out of the Worker — 500 instead of 400

Evidence

Reproduction (verified this run)

Why it matters

Acceptance criteria

Activity

dezren39 commented on Oct 30, 2026

dezren39 commented on Oct 30, 2026

16 remaining items

dezren39 commented on Oct 31, 2026

dezren39 commented on Oct 31, 2026

dezren39 commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions