fix: drop redundant decodeURIComponent and repair urlencoded schema validation (#267)

* fix: URLSearchParams refactor broke valid urlencoded webhooks; drop redundant decodeURIComponent

The current `URL_ENCODED` branch of `parseRequestBody` has two bugs that combine to make every valid urlencoded GitHub webhook fail:

1. `bodySchema.parse(payloadParam)` is called with a `string | null` returned by `URLSearchParams.get("payload")`, but `bodySchema` is `z.object({ payload: z.string() })` — i.e. it expects an *object* with a `payload` key. zod throws `Invalid input: expected object, received string` on every valid payload, so the function returns `undefined`. The pre-existing fixture test (`fixtures/invalid-payload-urlencoded.txt`) hides this because it only exercises an invalid payload that's expected to be rejected with 403.

2. `JSON.parse(decodeURIComponent(payload))` calls `decodeURIComponent` a second time on a value `URLSearchParams.get` has already URL-decoded. This throws `URIError: URI malformed` whenever the decoded JSON contains a literal `%` that isn't part of a valid `%XX` escape — which is common in real PR titles, commit messages, and comments ("30% threshold", "set %USERPROFILE% to ~", "WHERE x LIKE '%foo%'", "printf(\"%s\", val)").

Fixes:

- Wrap the `URLSearchParams.get("payload")` value into the `{ payload: string }` shape the schema expects, so schema validation actually runs against valid payloads.
- Drop the redundant `decodeURIComponent(payload)` — `URLSearchParams.get` already URL-decodes once, which is exactly what GitHub's single-URL-encoded webhook body needs.

Tests: 9 new cases in `lambda/proxy.test.ts` cover the percent-character regression patterns plus a control and a `%20`-preservation case, exercised both end-to-end through the handler and directly against `parseRequestBody`.

* Apply suggestions from code review

Co-authored-by: Dan Adajian <danadajian@gmail.com>

---------

Co-authored-by: Dan Adajian <danadajian@gmail.com>

Author: lzeligman-mark43

lambda/parse-request-body.ts

@@ -27,9 +27,10 @@ export function parseRequestBody(
         return JSON.parse(body);
       case CONTENT_TYPES.URL_ENCODED:
         const params = new URLSearchParams(body);
-        const payloadParam = params.get("payload");
-        const { payload } = bodySchema.parse(payloadParam);
-        return JSON.parse(decodeURIComponent(payload));
+        const { payload } = bodySchema.parse({
+          payload: params.get("payload"),
+        });
+        return JSON.parse(payload);
     }
   } catch (error) {
     console.error(`Error parsing request body: ${error}`);

lambda/proxy.test.ts

@@ -12,6 +12,7 @@ limitations under the License.
 */
 
 import { handler } from "./proxy";
+import { parseRequestBody } from "./parse-request-body";
 import type { AxiosRequestHeaders, AxiosResponse } from "axios";
 import { readFileSync } from "fs";
 import { Agent } from "https";
@@ -318,4 +319,86 @@ describe("proxy", () => {
     });
     expect(axiosPostMock).toHaveBeenCalled();
   });
+
+  it("should forward a urlencoded webhook whose JSON contains literal '%' characters", async () => {
+    const payloadWithPercent = {
+      ...VALID_PUSH_PAYLOAD,
+      head_commit: {
+        ...(VALID_PUSH_PAYLOAD as any).head_commit,
+        message:
+          "Roll out 30% threshold; reference %USERPROFILE% on Windows; WHERE x LIKE '%foo%'",
+      },
+    };
+    const urlencodedBody =
+      "payload=" + encodeURIComponent(JSON.stringify(payloadWithPercent));
+    const destinationUrl = "https://approved.host/github-webhook/";
+    const endpointId = encodeURIComponent(destinationUrl);
+    const event: APIGatewayProxyWithLambdaAuthorizerEvent<any> = {
+      ...baseEvent,
+      headers: {
+        ...baseEvent.headers,
+        "content-type": "application/x-www-form-urlencoded",
+      },
+      body: urlencodedBody,
+      pathParameters: { endpointId },
+    };
+    const result = await handler(event);
+    expect(result).toEqual(expectedResponseObject);
+    expect(axiosPostMock).toHaveBeenCalled();
+  });
+});
+
+describe("parseRequestBody — urlencoded payloads with literal '%' characters", () => {
+  const headers = { "content-type": "application/x-www-form-urlencoded" };
+
+  const cases: Array<{ label: string; userContent: string }> = [
+    { label: "percentage in PR title", userContent: "30% threshold rollout" },
+    { label: "trailing percent", userContent: "rate: 5%" },
+    {
+      label: "Windows env var reference",
+      userContent: "set %USERPROFILE% to ~",
+    },
+    {
+      label: "SQL LIKE wildcard",
+      userContent: "WHERE name LIKE '%foo%' AND status = 1",
+    },
+    {
+      label: "C-style format string",
+      userContent: 'printf("%s\\n", val);',
+    },
+    { label: "Go format verb", userContent: 'log.Printf("%v", obj)' },
+    {
+      label: "bare % followed by non-hex",
+      userContent: "look here: %g and %h",
+    },
+  ];
+
+  for (const c of cases) {
+    it(`parses a webhook whose JSON contains literal '%' (${c.label})`, () => {
+      const json = JSON.stringify({
+        action: "opened",
+        pull_request: { title: c.userContent, body: c.userContent },
+      });
+      const body = "payload=" + encodeURIComponent(json);
+      const result = parseRequestBody(body, headers);
+      expect(result).toBeDefined();
+      expect((result as any).pull_request.title).toBe(c.userContent);
+    });
+  }
+
+  it("still parses payloads with no '%' characters (control)", () => {
+    const json = JSON.stringify({ action: "opened", number: 42 });
+    const body = "payload=" + encodeURIComponent(json);
+    const result = parseRequestBody(body, headers);
+    expect(result).toBeDefined();
+    expect((result as any).number).toBe(42);
+  });
+
+  it("correctly preserves valid percent-escapes (%20 → space) inside JSON string values", () => {
+    const literalText = "encoded as %20 example";
+    const json = JSON.stringify({ comment: { body: literalText } });
+    const body = "payload=" + encodeURIComponent(json);
+    const result = parseRequestBody(body, headers);
+    expect((result as any).comment.body).toBe(literalText);
+  });
 });