Fix: Prevent double decodeURIComponent on file query param (#20264)

Summary
This PR fixes a regression where the file query parameter is being double-decoded in web/app.js → run(config).

In ui_utils.js, parseQueryString() already applies decodeURIComponent to query params.

Later, in app.js, decodeURIComponent(file) is called again before passing it into new URL(...).

This double-decoding corrupts encoded values (%2B → +, %3D → =), causing Azure Blob SAS URLs and other signed URLs to fail with 403 Forbidden.

Changes

- file = new URL(decodeURIComponent(file)).href;
+ file = new URL(file).href;

Steps to Reproduce

Use viewer.html?file=<encodeURIComponent(SAS_URL)> with an Azure Blob SAS token.

Observe the request fails with 403 due to signature mismatch.

Expected behavior
The PDF should load correctly from Azure Blob storage (or any service relying on signed URLs).

Bug Reference
Closes #20264

Additional Context

Worked correctly in v5.3.31.

Regression introduced in v5.4.x.
This commit is contained in:
Aditya kumar singh 2025-09-15 23:47:32 +05:30
parent bd2ce9c248
commit a7c074db04

View File

@ -777,7 +777,7 @@ const PDFViewerApplication = {
const params = parseQueryString(queryString);
file = params.get("file") ?? AppOptions.get("defaultUrl");
try {
file = new URL(decodeURIComponent(file)).href;
file = new URL(file).href;
} catch {
file = encodeURIComponent(file).replaceAll("%2F", "/");
}