Skip to content

fix: Decode percent-encoded image data URLs - #2617

Open
GtechGovind wants to merge 1 commit into
Automattic:masterfrom
GtechGovind:fix/percent-encoded-image-data
Open

fix: Decode percent-encoded image data URLs#2617
GtechGovind wants to merge 1 commit into
Automattic:masterfrom
GtechGovind:fix/percent-encoded-image-data

Conversation

@GtechGovind

Copy link
Copy Markdown

Fixes #2126.

I added percent-decoding for image data-URL payloads so encoded SVGs and binary images load correctly. Decoding works on bytes rather than using decodeURIComponent, which rejects valid non-UTF-8 image bytes and literal percentages in SVGs.

  • Decode valid %xx escapes once, preserving raw UTF-8, plus signs, and malformed escape sequences.
  • Decode percent escapes before base64, as specified by the data-URL processing algorithm.
  • Keep the existing fast path for payloads without percent signs. File, Buffer, HTTP, and object-URL loading are unchanged, as are source getters and callback behavior.
  • Add 15 decoder tests and five image integration tests, including rendered pixel comparisons. Update the changelog.

Validation on macOS Apple Silicon:

  • zig build -j4 with Zig 0.16.0: passed.
  • npm test -- --reporter dot on Node 24.19.0: 325 passed, six existing pending tests.
  • node node_modules/mocha/bin/mocha.js --reporter dot 'test/*.test.js' on Node 26.0.0: 325 passed, six existing pending tests.
  • npm run lint, npm run tsd, and targeted Standard checks for the new decoder/test files: passed.
  • The three encoded PNG/base64/SVG regression cases failed with Unsupported image type before the implementation and pass afterward.
  • An additional 144 deterministic payload combinations matched Node's fetch(dataURL) byte output, covering UTF-8, binary bytes, plus signs, literal percentages, and partial/invalid escapes.

Linux/Windows and the generated WPT suite were not run locally. This change does not attempt to overhaul existing data-URL metadata parsing or base64 validation.

  • Have you updated CHANGELOG.md?

@GtechGovind
GtechGovind marked this pull request as ready for review August 28, 2026 06:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Data-URI doesn't handle URI-encoding (percent-escaping)

1 participant