From b10efcc1bf91487e04f76e855583290c5c7a7d16 Mon Sep 17 00:00:00 2001
From: Codex Microtask Operator <codex-microtask@example.com>
Date: Fri, 12 Jun 2026 18:35:13 +0200
Subject: [PATCH] Handle malformed static paths

---
 apps/commandboard-web/server.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/apps/commandboard-web/server.js b/apps/commandboard-web/server.js
index 6a61e34..a0d357f 100644
--- a/apps/commandboard-web/server.js
+++ b/apps/commandboard-web/server.js
@@ -48,7 +48,12 @@ createServer((request, response) => {
 });
 
 function resolveStaticPath(pathname) {
-  const decodedPath = decodeURIComponent(pathname);
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
   const normalizedPath = normalize(decodedPath).replace(/^(\.\.[/\\])+/, "");
   let candidate = join(distDirectory, normalizedPath);