{"record":{"id":"b9521a347bbd705c","repo":"different-ai/openwork","slug":"ref-name-received-malformed-uri-data-error-i","errorCode":null,"errorMessage":"${ref.name} received malformed URI data: ${error instanceof Error ? error.message : String(error)}","messagePattern":"(.+?) received malformed URI data: (.+?)","errorType":"exception","errorClass":"InterpreterRuntimeError","httpStatus":null,"severity":"error","filePath":"packages/codemode/src/stdlib/url.ts","lineNumber":61,"sourceCode":"])\n\nexport const uriArgument = (value: unknown, label: string): string => coerceToString(boundedData(value, label))\n\nexport const invokeUriFunction = (ref: UriFunction, args: Array<unknown>, node: AstNode): string => {\n  const value = uriArgument(args[0], `${ref.name} input`)\n  try {\n    switch (ref.name) {\n      case \"encodeURI\":\n        return encodeURI(value)\n      case \"encodeURIComponent\":\n        return encodeURIComponent(value)\n      case \"decodeURI\":\n        return decodeURI(value)\n      case \"decodeURIComponent\":\n        return decodeURIComponent(value)\n    }\n  } catch (error) {\n    throw new InterpreterRuntimeError(\n      `${ref.name} received malformed URI data: ${error instanceof Error ? error.message : String(error)}`,\n      node,\n    ).as(\"URIError\")\n  }\n}\n\nexport const urlArgument = (value: unknown, label: string): string =>\n  value instanceof SandboxURL ? value.url.href : uriArgument(value, label)\n\nexport const invokeURLStatic = (name: string, args: Array<unknown>, node: AstNode): unknown => {\n  if (!urlStatics.has(name)) throw new InterpreterRuntimeError(`URL.${name} is not available in CodeMode.`, node)\n  if (args.length === 0) throw new InterpreterRuntimeError(`URL.${name} requires a URL argument.`, node).as(\"TypeError\")\n  const input = urlArgument(args[0], `URL.${name} input`)\n  const base = args[1] === undefined ? undefined : urlArgument(args[1], `URL.${name} base`)\n  try {\n    const url = new URL(input, base)\n    return name === \"canParse\" ? true : new SandboxURL(url)\n  } catch {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/packages/codemode/src/stdlib/url.ts#L43-L79","documentation":"encodeURI/decodeURI/encodeURIComponent/decodeURIComponent are wrapped so malformed input surfaces as a sandbox URIError with a clear message. The host throws when decoding invalid escape sequences (e.g. a stray %) or encoding lone surrogates; the wrapper rethrows it tagged as URIError with the original message.","triggerScenarios":"`decodeURIComponent(\"%\")` or `decodeURIComponent(\"%E0%A4%A\")` (truncated/invalid percent-escape); `encodeURI(\"\\uD800\")` (lone surrogate).","commonSituations":"Decoding user-supplied or third-party query strings that contain raw % characters; splitting an encoded string mid-escape before decoding; handling binary data chopped at arbitrary byte boundaries.","solutions":["Validate/escape % as %25 before decoding user input.","Wrap decode in try/catch and fall back to the raw value on failure.","Ensure encoded strings are not split in the middle of a %XX sequence (decode before slicing).","Replace lone surrogates or use well-formed string handling before encodeURI."],"exampleFix":"// before\nconst decoded = decodeURIComponent(raw) // raw may contain \"%\"\n// after\nconst decoded = raw.includes(\"%\") ? decodeURIComponent(raw.replace(/%(?![0-9A-Fa-f]{2})/g, \"%25\")) : raw","handlingStrategy":"try-catch","validationCode":"const safeDecode = (s) => typeof s === \"string\" && !/%(?![0-9A-Fa-f]{2})/.test(s) ? decodeURIComponent(s) : s","typeGuard":null,"tryCatchPattern":"try { out = decodeURIComponent(raw) } catch (e) { out = raw /* or log + fallback */ }","preventionTips":["Escape bare % before decoding untrusted input","Decode before splitting/slicing strings","Check for lone surrogates before encodeURI"],"tags":["codemode","uri","encoding","sandbox"],"backgroundTag":"malformed-uri-component","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}