inspector/core
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall 52abe8a165 fix: count a pct-triplet as one character when truncating a prefix
Addresses Copilot's round-9 review on #2035.

RFC 6570 2.4.1 counts the prefix in *characters* and is explicit that a
pct-encoded triplet counts as a single one. Truncation went by code point,
so it cut a triplet in half -- measured on 6acaff70:

  x{+v:5}  v = "%61%62%63%64%65%66"  =>  "x%61%256"

The orphaned "%6" is not a triplet, so encodeAllowReserved then (correctly)
escaped its `%`, and the value went out carrying a byte the caller never
asked for. Now "x%61%62%63%64%65".

Triplets are units only under `+` and `#`. Under every other operator the
encoder escapes a `%` anyway (`%61` -> `%2561`), so the three characters
really are three and grouping them would mis-count the prefix -- asserted
both ways. Astral code points remain single units under both, which is what
`Array.from` was there for.

Also corrects the comment on `readResourceFromTemplate`, which still said
the shared helper drops blank values. It has not since 6acaff70: `params`
passes through as given, so only an absent key omits its expression and a
direct API caller can request `?q=` deliberately. A caller whose values come
from a form drops its own blanks first.

Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-16 23:18:20 -04:00
..
auth feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
client feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
json fix: decline empty enums, drop mislabelling enumNames, treat $ref as opaque 2026-08-15 20:27:19 -04:00
logging feat: port CLI, TUI, and launcher from v1.5 into v2 (#1452) 2026-06-14 20:27:49 -04:00
mcp fix: count a pct-triplet as one character when truncating a prefix 2026-08-16 23:18:20 -04:00
node feat(web): enforce localhost-only binding; expand loopback origin allow-list (#1796) 2026-07-26 22:15:10 -04:00
react fix: salvage a list result's valid entries when one is malformed (#1909) 2026-08-15 16:52:11 -04:00
storage fix(auth): keep oauth-persist browser-safe (move Node file backend out) 2026-07-08 16:20:31 -04:00
tsconfig.json feat: port CLI, TUI, and launcher from v1.5 into v2 (#1452) 2026-06-14 20:27:49 -04:00