fix: parse raw query string for deep link params to avoid double-decode

Previous fix used URLSearchParams.get() which already fully decodes,
then called decodeURIComponent() again causing double-decode of %
sequences. Parse raw query string pairs directly instead —
decodeURIComponent does not treat + as space, preserving base64.
This commit is contained in:
Fringg
2026-02-23 15:59:43 +03:00
parent 65add9a111
commit ed65c29bac

View File

@@ -61,12 +61,19 @@ export default function DeepLinkRedirect() {
const logoLetter = branding?.logo_letter || import.meta.env.VITE_APP_LOGO || 'V'; const logoLetter = branding?.logo_letter || import.meta.env.VITE_APP_LOGO || 'V';
const logoUrl = branding ? brandingApi.getLogoUrl(branding) : null; const logoUrl = branding ? brandingApi.getLogoUrl(branding) : null;
// Get raw URL parameter preserving '+' chars (URLSearchParams decodes '+' as space, breaking base64 in crypto links) // Parse raw query string to preserve '+' chars in base64 crypto links.
const getRawParam = (key: string) => { // URLSearchParams decodes '+' as space, breaking ss://, vless:// etc.
const params = new URLSearchParams(window.location.search); // decodeURIComponent does NOT treat '+' as space, so parsing raw pairs is correct.
const raw = params.get(key); const getRawParam = (key: string): string => {
if (!raw) return ''; const search = window.location.search.substring(1);
return decodeURIComponent(raw.replace(/ /g, '+')); for (const pair of search.split('&')) {
const idx = pair.indexOf('=');
if (idx === -1) continue;
if (decodeURIComponent(pair.substring(0, idx)) === key) {
return decodeURIComponent(pair.substring(idx + 1));
}
}
return '';
}; };
// Get parameters // Get parameters