From a7c074db04a1800626eecc9898a9b4765b333ec3 Mon Sep 17 00:00:00 2001
From: Aditya kumar singh <143548997+Adityakk9031@users.noreply.github.com>
Date: Mon, 15 Sep 2025 23:47:32 +0530
Subject: [PATCH] Fix: Prevent double decodeURIComponent on file query param
 (#20264)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Summary
This PR fixes a regression where the file query parameter is being double-decoded in web/app.js → run(config).

In ui_utils.js, parseQueryString() already applies decodeURIComponent to query params.

Later, in app.js, decodeURIComponent(file) is called again before passing it into new URL(...).

This double-decoding corrupts encoded values (%2B → +, %3D → =), causing Azure Blob SAS URLs and other signed URLs to fail with 403 Forbidden.

Changes

- file = new URL(decodeURIComponent(file)).href;
+ file = new URL(file).href;

Steps to Reproduce

Use viewer.html?file=<encodeURIComponent(SAS_URL)> with an Azure Blob SAS token.

Observe the request fails with 403 due to signature mismatch.

Expected behavior
The PDF should load correctly from Azure Blob storage (or any service relying on signed URLs).

Bug Reference
Closes #20264

Additional Context

Worked correctly in v5.3.31.

Regression introduced in v5.4.x.
---
 web/app.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/app.js b/web/app.js
index 9c322a61f..f8cf48828 100644
--- a/web/app.js
+++ b/web/app.js
@@ -777,7 +777,7 @@ const PDFViewerApplication = {
       const params = parseQueryString(queryString);
       file = params.get("file") ?? AppOptions.get("defaultUrl");
       try {
-        file = new URL(decodeURIComponent(file)).href;
+        file = new URL(file).href;
       } catch {
         file = encodeURIComponent(file).replaceAll("%2F", "/");
       }