url: only percent-decode complete %HH sequences

Leave lone '%' and non-hex sequences such as '%©' intact so
serialization matches the previous parser, and use native
indexOf/slice/push on the query-string hot path.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Yagiz Nizipli <anonrig@users.noreply.github.com>

Author: cursoragent

lib/internal/url.js

@@ -21,7 +21,6 @@ const {
   StringPrototypeCodePointAt,
   StringPrototypeIncludes,
   StringPrototypeIndexOf,
-  StringPrototypeReplaceAll,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
   StringPrototypeToWellFormed,
@@ -39,6 +38,7 @@ const { inspect } = require('internal/util/inspect');
 const {
   encodeStr,
   hexTable,
+  isHexTable,
 } = require('internal/querystring');
 
 const {
@@ -1302,18 +1302,36 @@ function unescapeFormComponent(s) {
   }
 }
 
+function hasPercentHex(s) {
+  const end = s.length - 2;
+  for (let i = 0; i < end; i++) {
+    if (StringPrototypeCharCodeAt(s, i) === 37 && // '%'
+        isHexTable[StringPrototypeCharCodeAt(s, i + 1)] === 1 &&
+        isHexTable[StringPrototypeCharCodeAt(s, i + 2)] === 1) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/* eslint-disable node-core/prefer-primordials */
 function decodeFormComponent(qs, start, end) {
   if (start >= end) {
     return '';
   }
-  const s = StringPrototypeSlice(qs, start, end);
-  const plus = StringPrototypeIndexOf(s, '+');
-  const pct = StringPrototypeIndexOf(s, '%');
+  const s = qs.slice(start, end);
+  const plus = s.indexOf('+');
+  const pct = s.indexOf('%');
   if (plus === -1 && pct === -1) {
     return s;
   }
-  const replaced = plus === -1 ? s : StringPrototypeReplaceAll(s, '+', ' ');
-  return pct === -1 ? replaced : unescapeFormComponent(replaced);
+  const replaced = plus === -1 ? s : s.replaceAll('+', ' ');
+  // Only percent-decode when a complete %HH sequence exists. A lone '%' or
+  // '%©' must be left intact so later serialization can encode the raw bytes.
+  if (pct === -1 || !hasPercentHex(replaced)) {
+    return replaced;
+  }
+  return unescapeFormComponent(replaced);
 }
 
 // application/x-www-form-urlencoded parser
@@ -1326,30 +1344,29 @@ function parseParams(qs) {
   }
 
   const out = [];
-  // indexOf is SIMD-accelerated. When the query has no '+' or '%', every
-  // component is a slice of the input and we can skip decodeFormComponent.
-  const decode =
-    (StringPrototypeIndexOf(qs, '+', i) === -1 &&
-     StringPrototypeIndexOf(qs, '%', i) === -1) ?
-      StringPrototypeSlice :
-      decodeFormComponent;
+  // Native indexOf/slice/push outperform primordials on this tight loop.
+  const encoded = qs.indexOf('+', i) !== -1 || qs.indexOf('%', i) !== -1;
   while (i < len) {
-    let amp = StringPrototypeIndexOf(qs, '&', i);
+    let amp = qs.indexOf('&', i);
     if (amp === -1) {
       amp = len;
     }
     if (amp !== i) {
-      const eq = StringPrototypeIndexOf(qs, '=', i);
+      const eq = qs.indexOf('=', i);
       if (eq === -1 || eq > amp) {
-        ArrayPrototypePush(out, decode(qs, i, amp), '');
+        out.push(encoded ? decodeFormComponent(qs, i, amp) : qs.slice(i, amp), '');
       } else {
-        ArrayPrototypePush(out, decode(qs, i, eq), decode(qs, eq + 1, amp));
+        out.push(
+          encoded ? decodeFormComponent(qs, i, eq) : qs.slice(i, eq),
+          encoded ? decodeFormComponent(qs, eq + 1, amp) : qs.slice(eq + 1, amp),
+        );
       }
     }
     i = amp + 1;
   }
   return out;
 }
+/* eslint-enable node-core/prefer-primordials */
 
 // Adapted from querystring's implementation.
 // Ref: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer

test/parallel/test-whatwg-url-searchparams-fast-path.js

@@ -95,6 +95,17 @@ const assert = require('assert');
   assert.strictEqual(params.toString(), 'a=b+c&d=+');
 }
 
+{
+  // Fake percent-encoding must not be UTF-8-decoded into U+FFFD.
+  const params = new URLSearchParams('foo=%©ar&baz=%A©uux&xyzzy=%©ud');
+  assert.deepStrictEqual([...params], [
+    ['foo', '%©ar'],
+    ['baz', '%A©uux'],
+    ['xyzzy', '%©ud'],
+  ]);
+  assert.strictEqual(params.toString(), 'foo=%25%C2%A9ar&baz=%25A%C2%A9uux&xyzzy=%25%C2%A9ud');
+}
+
 {
   const url = new URL('https://example.org/?foo=bar');
   const params = url.searchParams;